Cross-network collaborative alarm noise reduction method based on knowledge distillation large model

Abstract

The invention discloses a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model, and belongs to the technical field of network security. Comprising the following steps: deploying a server in a first network domain for operating a teacher model; a lightweight device is deployed in a second network domain needing to be protected and is used for operating a student model; a knowledge distillation module is established as a communication bridge between two networks. In the first network domain, training a teacher model by using the alarm data; after training is completed, the teacher model generates a knowledge data packet; the teacher model writes the generated knowledge data packet back to the knowledge distillation module and associates the knowledge data packet with the original reference alarm data; and the student model deployed in the second network domain simultaneously reads the reference alarm data and the corresponding knowledge data packet generated by the teacher model from the knowledge distillation module. According to the invention, the efficiency and accuracy of cross-network cooperative security alarm noise reduction are improved, and an efficient alarm noise reduction method is provided for the technical field of network security.

Description

Technical Field

[0001] This invention relates to a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model, belonging to the field of network security technology. Background Technology

[0002] In the field of cybersecurity, particularly in Network Operations Centers (NOCs) and Security Operations Centers (SOCs), alarm noise reduction is a long-standing and critical challenge. Existing monitoring systems generate a massive number of alarm events, the vast majority of which are false alarms or noise requiring no action. This alarm fatigue phenomenon not only severely consumes operational resources but also significantly increases the risk of real, serious threats being overlooked.

[0003] Early alarm denoising methods relied heavily on static algorithmic rules or frequency-based correlation analysis (such as the Apriori algorithm). However, these methods struggled to handle unstructured text in alarm data and performed poorly with high-dimensional data and unforeseen attack patterns, lacking an understanding of the deep semantic relationships between alarm events.

[0004] In recent years, deep learning (DL) models, especially graph neural networks (GNNs), have been widely used in network intrusion detection due to their ability to effectively model the topology and complex dependencies of network attacks. However, when these advanced models are deployed directly in highly isolated secure intranets (such as enterprise core networks or industrial control networks), their analytical capabilities are limited by local network data, lacking a global understanding of emerging threats and attack methods worldwide, thus limiting their "vision".

[0005] To transmit data between networks with different security levels, the industry typically employs two technologies. The first is hardware data diodes, which physically enforce unidirectional data flow, offering extremely high security. However, they are essentially "dumb pipes," only capable of transmitting raw data bitstreams and lacking any intelligent processing or abstraction capabilities. The second is Federated Learning (FL), a distributed learning paradigm designed to protect data privacy. Its core principle is that data remains stationary while model parameters are aggregated. However, the peer-to-peer, aggregation architecture of Federated Learning is incompatible with the specific security requirements of unidirectional, guided knowledge transfer between internal and external networks, and it faces challenges when handling heterogeneous models.

[0006] Therefore, this invention innovatively proposes a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model. Summary of the Invention

[0007] To address the aforementioned issues, this invention provides a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model. This invention distills the global threat insight of a first network domain large model and applies it to a lightweight model of a second network domain, thereby reducing false alarms and false negatives caused by the lack of a global perspective in the second network domain model, and improving the efficiency, accuracy, and detection capability of alarm noise reduction and advanced collaborative attacks.

[0008] The technical solution of this invention is: This invention provides a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model, the method comprising:

[0009] S1. Deploy a server in the first network domain to run the teacher model; deploy a lightweight device in the second network domain that needs protection to run the student model; establish a knowledge distillation module to serve as a communication bridge between the two networks;

[0010] S2. In the first network domain, the teacher model is trained using alarm data; after training, the teacher model begins to process the reference alarm data stored in the knowledge distillation module and generates knowledge data packets.

[0011] S3. The teacher model writes the generated knowledge data package back to the knowledge distillation module and associates it with the original reference alarm data;

[0012] S4. The student model deployed in the second network domain simultaneously reads reference alarm data and corresponding knowledge data packets generated by the teacher model from the knowledge distillation module, and trains the student model by minimizing the composite loss function based on the read reference alarm data.

[0013] S5. After training, for each new alarm, the student model uses its knowledge distillation skills to perform noise reduction and priority ranking; the student model performs real-time inference on the intranet, while the teacher model analyzes new data and updates the knowledge base in the first domain.

[0014] Further, S1 includes:

[0015] The model parameters and model structure in the first and second domains can be the same or different.

[0016] Further, S2 includes:

[0017] S21. First, convert the discrete, unstructured alarm events into an ordered input sequence;

[0018] Map each individual alarm event or its key attributes to a unique integer identifier, i.e., a tag;

[0019] The input sequence is first converted into an embedding matrix, which is composed of the sum of the label embedding and the position embedding;

[0020] S22. The main body of the teacher model consists of one or more stacked Transformer encoder layers; each encoder layer contains two core sub-layers: a multi-head self-attention mechanism and a feedforward neural network;

[0021] The embedding matrix is ​​linearly projected onto three matrices: query Q, key K, and value V; the attention score is obtained by computing the dot product of the query and the key, and then scaled to stabilize the gradient.

[0022] The scaled attention score is then converted into weights using a softmax function; the final output is a weighted sum of the values. The core logic formula of the multi-head self-attention sublayer is scaled dot product attention. :

[0023]

[0024] in, It is the dimension of the key vector. It is the softmax function;

[0025] In addition, the output of each attention sub-layer passes through a fully connected feedforward neural network, which is applied independently to each position in the sequence; the output of each attention sub-layer is residually connected to the input of that attention sub-layer, and then layer normalization is performed.

[0026] S23. Teacher model training and optimization:

[0027] Teacher Model In an alarm dataset Training is conducted on the above, among which, It is an alarm sequence. It is its corresponding real label, and M is the total number of alarm sequences;

[0028] The goal of training is to minimize the cross-entropy loss function. ,make Let be the parameters of the teacher model, then the optimization problem can be expressed as:

[0029]

[0030] in, The teacher model is for alarm sequences The final output, It is the cross-entropy function;

[0031] S24. After training is complete, the teacher model processes the reference alarm sequences from the shared repository and generates knowledge data packages;

[0032] Among them, response-based knowledge is the final predicted output of the teacher model, let Let C be the original output of the teacher model for a given alarm sequence, where C represents the total number of threat categories output by the teacher model, which is the number of all possible threat categories when the teacher model classifies the alarm sequence. The formula for calculating the soft target probability vector q is:

[0033]

[0034] in, >1 is the temperature parameter. This soft target probability vector q reveals the confidence distribution and similarity judgment of the teacher model among different threat categories.

[0035] The j-th element of the soft target probability vector q represents the confidence of the teacher model that the current alarm sequence belongs to the j-th threat category;

[0036] The j-th element of the teacher model's original output logits for the current alarm sequence is the original score of the j-th threat category before softmax normalization, reflecting the model's original preference for that category.

[0037] The k-th element of the teacher model's original output for the current alarm sequence, where k iterates through all C threat categories (k=1,2,...,C), is used to calculate the denominator of the softmax normalization, ensuring that q satisfies the condition that the sum of the probabilities of all categories is 1; In this context, j is the threat category index, used to describe the probability values ​​of different categories within a single soft target probability vector;

[0038] In summary, for each reference alarm sequence in the shared repository Knowledge data packages generated by the teacher model Formalized as a tuple containing multiple pieces of knowledge: ;

[0039] in, It is the i-th reference alarm sequence The corresponding complete soft target probability vector It is a feature embedding vector, and It is one or more attention weight matrices.

[0040] Further, S3 includes:

[0041] The data in the knowledge distillation module is organized into a structured collection, in which each original reference alarm data is explicitly associated with a knowledge data package generated by the teacher model.

[0042] Further, S4 includes:

[0043] A cryptographic model based on digital signatures is used for the transmission and storage of knowledge data packets;

[0044] The teacher model holds a pair of asymmetric keys: a private key. and a public key For each generated knowledge data package The teacher model first uses a standard cryptographic hash function to compute its digest. :

[0045]

[0046] The teacher model then uses its private key. Encrypt the hash digest to generate a digital signature. :

[0047]

[0048] Next, the teacher model will and Encapsulate them to obtain an enhanced knowledge data package The teacher model then adds enhanced knowledge data packages. Write it into the knowledge distillation module;

[0049] The student model reads enhanced knowledge data packages from the knowledge distillation module. The student model independently processes the received knowledge data. Calculate its summary :

[0050]

[0051] The student model uses the public key of the teacher model. Digital signatures Perform decryption verification;

[0052]

[0053] Only when Result is true, i.e. When the hash value obtained from decrypting the signature matches exactly, the student model accepts and uses the knowledge data packet. Continue training; if verification fails, discard the data packet.

[0054] By implementing access control policies on the knowledge distillation module, the unidirectional flow of knowledge is enforced at the logical level.

[0055] Define the set of operation permissions related to knowledge transfer:

[0056]

[0057] In the Permission-Role Assignment (PA) relationship, the following strict constraints are applied:

[0058] The teacher model is granted permission to write knowledge:

[0059]

[0060] The student model is granted access to knowledge:

[0061]

[0062] Student models are never granted the permission to write knowledge:

[0063]

[0064] Among them, Role Teacher Role student These represent the roles of the teacher model and the student model, respectively.

[0065] This set of mathematical permission allocation rules, combined with the aforementioned cryptographic model based on digital signatures, together construct a secure channel that allows only verified abstract knowledge to flow unidirectionally from the first domain to the second domain.

[0066] Furthermore, S4 also includes:

[0067] S41. Let the student model be a function. It consists of a set of learnable parameters. As defined, the student model receives an alarm data input x and outputs a set of predicted values. :

[0068]

[0069] S42. The training process of the student model is to minimize a composite loss function, which is a weighted sum of at least two component losses;

[0070]

[0071] in, It is the standard task loss, used to supervise student models learning basic classification tasks; It is the distillation loss, used to force the student model to mimic the output of the teacher model; It is a hyperparameter used to balance the importance of these two loss terms;

[0072] S43. The ultimate training goal of the student model is to find a set of optimal parameters. This makes the composite loss function minimize;

[0073] .

[0074] Further, S5 includes:

[0075] S51. After training, the optimized student model Its parameters are It is deployed in the second network domain to process real-time alarm streams;

[0076] make In time A real-time alarm event received from an internal network alarm source;

[0077] The student model applies the functions it has learned through distillation to infer the real-time alarm event and generate a predicted output vector. :

[0078]

[0079] This predicted output vector is then transformed into a probability distribution. ,in It belongs to the predefined alarm category set D;

[0080] S52. Order For the student model at time The parameter state; let For the knowledge distillation module at time Available knowledge set;

[0081] Teacher knowledge updates: The teacher model independently processes reference alarm data and updates the knowledge base; this process is represented as updates occurring at discrete time points. Update operations on the knowledge base:

[0082]

[0083] in, It is a batch of knowledge newly generated by the teacher model; Represents the time point of the i-th update. At that time, the set of knowledge available in the knowledge distillation module, It represents the discrete time point at which the teacher model updates the knowledge base for the i-th time. It is the latest set of knowledge in the knowledge distillation module after the i-th update;

[0084] The retraining process of the student model at discrete time points The student model uses the latest available knowledge at the start of training.

[0085]

[0086] in, This represents the reference alert dataset used for retraining the student model, serving as the foundational data for optimizing the student model parameters. The student model at training time j The state of the corresponding model parameters after training is complete;

[0087] Real-time inference for students: The real-time inference process of the student model is continuous, using the model parameters from the most recently trained model.

[0088]

[0089] in, It is the most recent training completion time point that is less than or equal to t. This refers to the alarm decision result.

[0090] The present invention also provides a cross-network collaborative alarm noise reduction system based on a knowledge distillation large model, the system including a module for executing the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0091] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned cross-network collaborative alarm noise reduction method based on a knowledge distillation large model.

[0092] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the cross-network collaborative alarm noise reduction method based on a knowledge distillation large model.

[0093] The beneficial effects of this invention are:

[0094] First, by establishing an asymmetric teacher-student architecture that spans network security boundaries, the global threat insight of the first domain model is distilled into abstract knowledge and transmitted unidirectionally, thereby reducing the risk of misjudgment caused by the limited vision of the second domain model, and significantly improving the accuracy of alarm noise reduction and the ability to identify complex collaborative attacks.

[0095] Secondly, by deploying a lightweight student model in the second network domain and adopting an asynchronous collaborative operation mode, this invention greatly reduces the high consumption of computing and storage resources on key internal devices, improves the feasibility of deploying advanced AI capabilities in resource-constrained environments, effectively avoids performance bottlenecks caused by network latency, and improves the real-time processing efficiency of the system.

[0096] Finally, by constructing a security architecture that is functionally equivalent to an intelligent knowledge diode, allowing only refined knowledge rather than raw data to flow between networks, the risk of sensitive data leakage or external attack penetration is fundamentally reduced, and the security isolation level of the entire system is improved. Attached Figure Description

[0097] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0098] Figure 1 This is a flowchart illustrating a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model provided by the present invention.

[0099] Figure 2 This is a flowchart illustrating the architecture of a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model provided by the present invention.

[0100] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention.

[0101] The labels in the diagram are as follows:

[0102] 310 - Processor; 320 - Communication interface; 330 - Memory; 340 - Communication bus. Detailed Implementation

[0103] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other.

[0104] It should be noted that the executing entity of the embodiments of the present invention can be various types of terminals, such as computers, smartphones, tablets, wearable devices, personal digital assistants (PDAs), mobile internet devices (MIDs), and other terminals capable of text processing. The present invention does not impose any restrictions on this.

[0105] Example 1: As Figure 1 As shown in the figure, this embodiment of the invention provides a cross-network collaborative alarm noise reduction method based on knowledge distillation, the method comprising:

[0106] S1. Deploy a server in the first network domain to run the teacher model; deploy a lightweight device in the second network domain that needs protection to run the student model; establish a knowledge distillation module to serve as a communication bridge between the two networks;

[0107] In some feasible implementations, S1 includes:

[0108] The model parameters and model structure in the first and second domains can be the same or different.

[0109] S2. In the first network domain, the teacher model is trained using alarm data; after training, the teacher model begins to process the reference alarm data stored in the knowledge distillation module and generates knowledge data packets.

[0110] In the first network domain, the goal of training the teacher model using alarm data is to enable the teacher model to learn the depth and generalization ability to distinguish between real threats and noise.

[0111] In some feasible implementations, S2 includes:

[0112] S21. To process alarm data using the Transformer model, the discrete, unstructured alarm events are first converted into an ordered input sequence;

[0113] Each individual alarm event or its key attributes (such as alarm type, source IP, destination port, timestamp, etc.) is mapped to a unique integer identifier, i.e., a token.

[0114] The Transformer model cannot directly process tokens; therefore, the input sequence is first converted into an embedding matrix. ,in This is the hidden dimension of the model; the embedding matrix is ​​composed of the sum of the label embeddings and the position embeddings.

[0115] S22. The core of the teacher model consists of one or more stacked Transformer encoder layers; each encoder layer contains two core sub-layers: a multi-head self-attention mechanism and a feedforward neural network; allowing the model to weigh the importance of all other labels in the sequence when processing each label in the sequence;

[0116] The embedding matrix is ​​linearly projected onto three matrices: query Q, key K, and value V; the attention score is obtained by computing the dot product of the query and the key, and then scaled to stabilize the gradient.

[0117] The scaled attention score is then converted into weights using a softmax function; the final output is a weighted sum of the values. The core logic formula of the multi-head self-attention sublayer is scaled dot product attention. :

[0118]

[0119] in, It is the dimension of the key vector. It is the softmax function;

[0120] In addition, the output of each attention sub-layer passes through a fully connected feedforward neural network, which is applied independently to each position in the sequence; the output of each attention sub-layer is residually connected to the input of that attention sub-layer, and then layer normalization is performed.

[0121] S23. Teacher model training and optimization:

[0122] Teacher Model In an alarm dataset Training is conducted on the above, among which, It is an alarm sequence. It is its corresponding real label, and M is the total number of alarm sequences;

[0123] The goal of training is to minimize the cross-entropy loss function. ,make Let be the parameters of the teacher model, then the optimization problem can be expressed as:

[0124]

[0125] in, The teacher model is for alarm sequences The final output, It is the cross-entropy function;

[0126] S24. After training, the teacher model processes the reference alarm sequences from the shared repository and generates knowledge data packages; for the Transformer architecture, the extractable knowledge is particularly rich, including response-based knowledge, feature-based knowledge, and relation-based knowledge, etc.

[0127] Among them, response-based knowledge is the final predicted output of the teacher model, let Let C be the original output of the teacher model for a given alarm sequence, where C represents the total number of threat categories output by the teacher model, which is the number of all possible threat categories when the teacher model classifies the alarm sequence. The formula for calculating the soft target probability vector q is:

[0128]

[0129] in, >1 is the temperature parameter. This soft target probability vector q reveals the confidence distribution and similarity judgment of the teacher model among different threat categories.

[0130] The j-th element of the soft target probability vector q represents the confidence of the teacher model that the current alarm sequence belongs to the j-th threat category;

[0131] The j-th element of the teacher model's original output logits for the current alarm sequence is the original score of the j-th threat category before softmax normalization, reflecting the model's original preference for that category.

[0132] The k-th element of the teacher model's original output for the current alarm sequence, where k iterates through all C threat categories (k=1,2,...,C), is used to calculate the denominator of the softmax normalization, ensuring that q satisfies the condition that the sum of the probabilities of all categories is 1; In this context, j is the threat category index, used to describe the probability values ​​of different categories within a single soft target probability vector;

[0133] In summary, for each reference alarm sequence in the shared repository Knowledge data packages generated by the teacher model Formalized as a tuple containing multiple pieces of knowledge: ;

[0134] in, It is the i-th reference alarm sequence The corresponding complete soft target probability vector It is a feature embedding vector, and It consists of one or more attention weight matrices. This structured data package is then stored in the knowledge distillation module, providing comprehensive and insightful guidance for the distillation training of the student model.

[0135] S3. The teacher model writes the generated knowledge data package back to the knowledge distillation module and associates it with the original reference alarm data;

[0136] This processing method ensures that only highly refined and abstracted knowledge can flow unidirectionally from the first domain to the second domain, without transmitting any raw or potentially harmful external data;

[0137] In some feasible implementations, S3 includes:

[0138] The data in the knowledge distillation module is organized into a structured collection, in which each original reference alarm data is explicitly associated with a knowledge data package generated by the teacher model.

[0139] S4. The student model deployed in the second network domain simultaneously reads reference alarm data and corresponding knowledge data packets generated by the teacher model from the knowledge distillation module, and trains the student model by minimizing the composite loss function based on the read reference alarm data.

[0140] The training objective of the student model is to imitate the thinking process of the teacher model; in this way, the student model effectively absorbs the wisdom and experience of the teacher model without directly accessing massive amounts of external data.

[0141] In some feasible implementations, S4 includes:

[0142] To ensure the security of knowledge data packets transmitted from the first domain to the second domain during transmission and storage, and to ensure that they indeed originate from a legitimate teacher model, this invention employs a cryptographic model based on digital signatures for the transmission and storage of knowledge data packets.

[0143] The teacher model holds a pair of asymmetric keys: a private key. and a public key For each generated knowledge data package The teacher model first uses a standard cryptographic hash function to compute its digest. :

[0144]

[0145] The teacher model then uses its private key. Encrypt the hash digest to generate a digital signature. :

[0146]

[0147] Next, the teacher model will and Encapsulate them to obtain an enhanced knowledge data package The teacher model then adds enhanced knowledge data packages. Write it into the knowledge distillation module;

[0148] The student model reads enhanced knowledge data packages from the knowledge distillation module. The student model independently processes the received knowledge data. Calculate its summary :

[0149]

[0150] The student model uses the public key of the teacher model. Digital signatures Perform decryption verification;

[0151]

[0152] Only when Result is true, i.e. When the hash value obtained from decrypting the signature matches exactly, the student model accepts and uses the knowledge data packet. Continue training; if verification fails, discard the data packet.

[0153] By implementing access control policies on the knowledge distillation module, the unidirectional flow of knowledge is enforced at the logical level.

[0154] Define the set of operation permissions related to knowledge transfer:

[0155]

[0156] In the Permission-Role Assignment (PA) relationship, the following strict constraints are applied:

[0157] The teacher model is granted permission to write knowledge:

[0158]

[0159] The student model is granted access to knowledge:

[0160]

[0161] Student models are never granted the permission to write knowledge:

[0162]

[0163] Among them, Role Teacher Rolestudent These represent the roles of the teacher model and the student model, respectively.

[0164] This set of mathematical permission allocation rules, combined with the aforementioned cryptographic model based on digital signatures, together construct a secure channel that allows only verified abstract knowledge to flow unidirectionally from the first domain to the second domain.

[0165] In some feasible implementations, S4 further includes:

[0166] S41. Let the student model be a function. It consists of a set of learnable parameters. As defined, the student model receives an alarm data input x and outputs a set of predicted values. :

[0167]

[0168] The student model is designed to be lightweight, with significantly fewer parameters and lower computational complexity than the teacher model.

[0169] S42. The training process of the student model is to minimize a composite loss function, which is a weighted sum of at least two component losses. The purpose is to achieve two goals simultaneously: learning to solve basic tasks and imitating the thinking process of the teacher model.

[0170]

[0171] in, It is the standard task loss, used to supervise student models learning basic classification tasks; It is the distillation loss, used to force the student model to mimic the output of the teacher model; It is a hyperparameter used to balance the importance of these two loss terms;

[0172] S43. The ultimate training goal of the student model is to find a set of optimal parameters. This makes the composite loss function minimize;

[0173] .

[0174] S5. After training, for each new alarm, the student model uses its knowledge distillation skills to perform noise reduction and priority ranking; the student model performs real-time inference on the intranet, while the teacher model analyzes new data and updates the knowledge base in the first domain.

[0175] In some feasible implementations, S5 includes:

[0176] S51. After training, the optimized student model Its parameters are It is deployed in the second network domain (secure intranet) to process real-time alarm streams;

[0177] make In time A real-time alarm event received from an internal network alarm source;

[0178] The student model applies the functions it has learned through distillation to infer the real-time alarm event and generate a predicted output vector. :

[0179]

[0180] This predicted output vector is then transformed into a probability distribution. ,in It belongs to the predefined alarm category set D;

[0181] The system architecture of this invention is designed to be asynchronous to decouple operations between internal and external networks, thereby making it robust to network latency. This contrasts sharply with synchronous distributed systems (such as traditional federated learning), whose performance is severely degraded by high communication latency.

[0182] S52. Order For the student model at time The parameter state; let For the knowledge distillation module at time The available knowledge set; teacher knowledge generation, student model training, and student real-time reasoning are decoupled in time;

[0183] Teacher knowledge updates: The teacher model independently processes reference alarm data and updates the knowledge base; this process is represented as updates occurring at discrete time points. Update operations on the knowledge base:

[0184]

[0185] in, It is a batch of knowledge newly generated by the teacher model; Represents the time point of the i-th update. At that time, the set of knowledge available in the knowledge distillation module, It represents the discrete time point at which the teacher model updates the knowledge base for the i-th time. It is the latest set of knowledge in the knowledge distillation module after the i-th update;

[0186] The retraining (or distillation) process of the student model at discrete time points The student model uses the latest available knowledge at the start of training.

[0187]

[0188] in, This represents the reference alert dataset used for retraining the student model, serving as the foundational data for optimizing the student model parameters. The student model at training time j The state of the corresponding model parameters after training is complete;

[0189] Real-time inference for students: The real-time inference process of the student model is continuous, using the model parameters from the most recently trained model.

[0190]

[0191] in, It is the most recent training completion time point that is less than or equal to t. This refers to the alarm decision result.

[0192] The present invention also provides a cross-network collaborative alarm noise reduction system based on a knowledge distillation large model, the system including a module for executing the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0193] This invention also provides an electronic device. Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340. The processor 310, communications interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions from the memory 330 to execute the aforementioned cross-network collaborative alarm noise reduction method based on a knowledge distillation large-scale model.

[0194] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0195] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned cross-network collaborative alarm noise reduction method based on a knowledge distillation large model.

[0196] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned cross-network collaborative alarm noise reduction method based on a knowledge distillation large model.

[0197] The core innovation of this invention lies in its unique asymmetric knowledge distillation framework that spans the cybersecurity domain. This framework abandons the traditional paradigm of deploying AI models in isolation within a single network or performing peer-to-peer aggregation in federated learning.

[0198] By introducing a novel "teacher-student" knowledge transfer mechanism at the system architecture level, this method functionally constructs an intelligent "knowledge diode": a powerful teacher model deployed in the first network domain with a global perspective, responsible for learning and extracting highly abstract threat patterns and alarm noise reduction logic from massive amounts of data; subsequently, this refined, non-raw data "knowledge" flows into the second network domain in a unidirectional and irreversible manner through a secure knowledge distillation module to guide the lightweight student model.

[0199] This architecture, characterized by a fixed model and fluid knowledge flow, fundamentally differs from the symmetrical aggregation model of federated learning, which features fixed data and fluid models. It not only solves the problem of insufficient noise reduction capabilities caused by the limited "field of vision" of the second domain model, but also avoids the security risks associated with directly transmitting raw data across networks, ultimately achieving a breakthrough balance between ensuring high-level security isolation and realizing advanced intelligent analysis capabilities.

[0200] To illustrate the effects of the present invention, the present invention is described in comparison from the following aspects, and the results are shown in Table 1.

[0201] Table 1: Comparison of Automation Level and Advantages / Disadvantages of Different Methods

[0202] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0203] The above-described contents can be implemented individually or in various combinations, and these variations are all within the protection scope of this invention.

[0204] It should be noted that in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the article or device comprising said element.

[0205] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. The present invention has been described in detail with reference to preferred embodiments. Those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications and substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A cross-network collaborative alarm noise reduction method based on a knowledge distillation large model, characterized in that: The method includes: S1. Deploy a server in the first network domain to run the teacher model; deploy a lightweight device in the second network domain that needs protection to run the student model; establish a knowledge distillation module to serve as a communication bridge between the two networks; S2. In the first network domain, the teacher model is trained using alarm data; after training, the teacher model begins to process the reference alarm data stored in the knowledge distillation module and generates knowledge data packets. S3. The teacher model writes the generated knowledge data package back to the knowledge distillation module and associates it with the original reference alarm data; S4. The student model deployed in the second network domain simultaneously reads reference alarm data and corresponding knowledge data packets generated by the teacher model from the knowledge distillation module, and trains the student model by minimizing the composite loss function based on the read reference alarm data. S5. After training, for each new alarm, the student model uses its knowledge distillation skills to perform noise reduction and priority ranking; the student model performs real-time inference on the intranet, while the teacher model analyzes new data and updates the knowledge base in the first domain.

2. The cross-network collaborative alarm noise reduction method based on a knowledge distillation large model according to claim 1, characterized in that: S1 includes: The model parameters and model structure in the first and second domains can be the same or different.

3. The cross-network collaborative alarm noise reduction method based on a knowledge distillation large model according to claim 1, characterized in that: S2 includes: S21. First, convert the discrete, unstructured alarm events into an ordered input sequence; Map each individual alarm event or its key attributes to a unique integer identifier, i.e., a tag; The input sequence is first converted into an embedding matrix, which is composed of the sum of the label embedding and the position embedding; S22. The main body of the teacher model consists of one or more stacked Transformer encoder layers; each encoder layer contains two core sub-layers: a multi-head self-attention mechanism and a feedforward neural network; The embedding matrix is ​​linearly projected onto three matrices: query Q, key K, and value V; the attention score is obtained by computing the dot product of the query and the key, and then scaled to stabilize the gradient. The scaled attention score is then converted into weights using a softmax function; the final output is a weighted sum of the values. The core logic formula of the multi-head self-attention sublayer is scaled dot product attention. : ； in, It is the dimension of the key vector. It is the softmax function; In addition, the output of each attention sub-layer passes through a fully connected feedforward neural network, which is applied independently to each position in the sequence; the output of each attention sub-layer is residually connected to the input of that attention sub-layer, and then layer normalization is performed. S23. Teacher model training and optimization: Teacher Model In an alarm dataset Training is conducted on the above, among which, It is an alarm sequence. It is its corresponding real label, and M is the total number of alarm sequences; The goal of training is to minimize the cross-entropy loss function. ,make Let be the parameters of the teacher model, then the optimization problem can be expressed as: ； in, The teacher model is for alarm sequences The final output, It is the cross-entropy function; S24. After training is complete, the teacher model processes the reference alarm sequences from the shared repository and generates knowledge data packages; Among them, response-based knowledge is the final predicted output of the teacher model, let Let C be the original output of the teacher model for a given alarm sequence, where C represents the total number of threat categories output by the teacher model, which is the number of all possible threat categories when the teacher model classifies the alarm sequence. The formula for calculating the soft target probability vector q is: ； in, >1 is the temperature parameter. This soft target probability vector q reveals the confidence distribution and similarity judgment of the teacher model among different threat categories. The j-th element of the soft target probability vector q represents the confidence of the teacher model that the current alarm sequence belongs to the j-th threat category; The j-th element of the teacher model's original output logits for the current alarm sequence is the original score of the j-th threat category before softmax normalization, reflecting the model's original preference for that category. The k-th element of the teacher model's original output for the current alarm sequence, where k iterates through all C threat categories (k=1,2,...,C), is used to calculate the denominator of the softmax normalization, ensuring that q satisfies the condition that the sum of the probabilities of all categories is 1; In this context, j is the threat category index, used to describe the probability values ​​of different categories within a single soft target probability vector; In summary, for each reference alarm sequence in the shared repository Knowledge data packages generated by the teacher model Formalized as a tuple containing multiple pieces of knowledge: ; in, It is the i-th reference alarm sequence The corresponding complete soft target probability vector It is a feature embedding vector, and It is one or more attention weight matrices.

4. The cross-network collaborative alarm noise reduction method based on a knowledge distillation large model according to claim 1, characterized in that: S3 includes: The data in the knowledge distillation module is organized into a structured collection, in which each original reference alarm data is explicitly associated with a knowledge data package generated by the teacher model.

5. The cross-network collaborative alarm noise reduction method based on a knowledge distillation large model according to claim 1, characterized in that: S4 includes: A cryptographic model based on digital signatures is used for the transmission and storage of knowledge data packets; The teacher model holds a pair of asymmetric keys: a private key. and a public key For each generated knowledge data package The teacher model first uses a standard cryptographic hash function to compute its digest. : ； The teacher model then uses its private key. Encrypt the hash digest to generate a digital signature. : ； Next, the teacher model will and Encapsulate them to obtain an enhanced knowledge data package The teacher model then adds enhanced knowledge data packages. Write it into the knowledge distillation module; The student model reads enhanced knowledge data packages from the knowledge distillation module. The student model independently processes the received knowledge data. Calculate its summary : ； The student model uses the public key of the teacher model. Digital signatures Perform decryption verification; ； Only when Result is true, i.e. When the hash value obtained from decrypting the signature matches exactly, the student model accepts and uses the knowledge data packet. Continue training; if verification fails, discard the data packet. By implementing access control policies on the knowledge distillation module, the unidirectional flow of knowledge is enforced at the logical level. Define the set of operation permissions related to knowledge transfer: ； In the Permission-Role Assignment (PA) relationship, the following strict constraints are applied: The teacher model is granted permission to write knowledge: ； The student model is granted access to knowledge: ； Student models are never granted the permission to write knowledge: ； Among them, Role Teacher Role student These represent the roles of the teacher model and the student model, respectively. This set of mathematical permission allocation rules, combined with a cryptographic model based on digital signatures, together construct a secure channel that allows only verified abstract knowledge to flow unidirectionally from the first domain to the second domain.

6. The cross-network collaborative alarm noise reduction method based on a knowledge distillation large model according to claim 1, characterized in that: S4 further includes: S41. Let the student model be a function. It consists of a set of learnable parameters. As defined, the student model receives an alarm data input x and outputs a set of predicted values. : ； S42. The training process of the student model is to minimize a composite loss function, which is a weighted sum of at least two component losses; ; in, It is the standard task loss, used to supervise student models learning basic classification tasks; It is the distillation loss, used to force the student model to mimic the output of the teacher model; It is a hyperparameter used to balance the importance of these two loss terms; S43. The ultimate training goal of the student model is to find a set of optimal parameters. This makes the composite loss function minimize; 。 7. The cross-network collaborative alarm noise reduction method based on a knowledge distillation large model according to claim 1, characterized in that: S5 includes: S51. After training, the optimized student model Its parameters are It is deployed in the second network domain to process real-time alarm streams; make In time A real-time alarm event received from an internal network alarm source; The student model applies the functions it has learned through distillation to infer the real-time alarm event and generate a predicted output vector. : ； This predicted output vector is then transformed into a probability distribution. ,in It belongs to the predefined alarm category set D; S52. Order For the student model at time The parameter state; let For the knowledge distillation module at time Available knowledge set; Teacher knowledge updates: The teacher model independently processes reference alarm data and updates the knowledge base; this process is represented as updates occurring at discrete time points. Update operations on the knowledge base: ； in, It is a batch of knowledge newly generated by the teacher model; Represents the time point of the i-th update. At that time, the set of knowledge available in the knowledge distillation module, It represents the discrete time point at which the teacher model updates the knowledge base for the i-th time. It is the latest set of knowledge in the knowledge distillation module after the i-th update; The retraining process of the student model at discrete time points The student model uses the latest available knowledge at the start of training. ； in, This represents the reference alert dataset used for retraining the student model, serving as the foundational data for optimizing the student model parameters. The student model at training time j The state of the corresponding model parameters after training is complete; Real-time inference for students: The real-time inference process of the student model is continuous, using the model parameters from the most recently trained model. ； in, It is the most recent training completion time point that is less than or equal to t. This refers to the alarm decision result.

8. A cross-network collaborative alarm and noise reduction system based on a knowledge distillation large-scale model, characterized in that, The system includes a module for performing a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model as described in any one of claims 1-7.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the cross-network collaborative alarm noise reduction method based on a knowledge distillation large model as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the cross-network collaborative alarm noise reduction method based on a knowledge distillation large model as described in any one of claims 1-7.

Images