A cross-network collaborative alarm noise reduction method based on a knowledge distillation large model

Abstract

The application discloses a kind of cross-network collaborative alarm noise reduction methods based on knowledge distillation large model, belong to network security technical field.The application includes: deploying a server in the first network domain, for running teacher model.Deploy a lightweight device in the second network domain that needs protection, for running student model;Establish a knowledge distillation module as the communication bridge between two networks.In the first network domain, the teacher model is trained using alarm data;After training is completed, the teacher model generates knowledge data packet;Teacher model writes back the knowledge data packet generated in knowledge distillation module, and is associated with original reference alarm data;Student model deployed in the second network domain simultaneously reads reference alarm data and corresponding knowledge data packet generated by teacher model from knowledge distillation module.The application improves the efficiency and accuracy of cross-network collaborative security alarm noise reduction, and provides an efficient alarm noise reduction method for network security technical field.

Description

TECHNICAL FIELD

[0001] The application relates to a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model and belongs to the technical field of network security. BACKGROUND

[0002] In the field of network security, especially in network operation centers (NOCs) and security operation centers (SOCs), alarm noise reduction is a long-standing key challenge. Existing monitoring systems generate a large number of alarm events, most of which are false positives or noise that does not require operation. This alarm fatigue phenomenon not only seriously consumes operational resources, but also greatly increases the risk of real and serious threats being ignored.

[0003] Early alarm noise reduction methods rely heavily on static algorithm rules or frequency-based association analysis (such as the Apriori algorithm). However, these methods struggle to handle unstructured text in alarm data and perform poorly in high-dimensional data and unforeseen attack patterns, lacking an understanding of the deep semantic relationships between alarm events.

[0004] In recent years, deep learning (DL) models, particularly graph neural networks (GNNs), have been widely used in network intrusion detection due to their ability to effectively model the topology and complex dependencies of network attacks. However, when these advanced models are directly deployed in highly isolated secure intranets (such as enterprise core networks or industrial control networks), their analysis capabilities are limited to local network data, lacking global awareness of emerging threats and attack methods worldwide, resulting in limited "vision".

[0005] To transfer data between networks of different security levels, two technologies are commonly used. The first is a hardware data diode, which physically enforces one-way data flow, providing high security, but its essence is a "dumb pipe" that can only transmit raw data bit streams without any intelligent processing or abstraction capabilities. The second is federated learning (FL), a distributed learning paradigm designed to protect data privacy, which involves data immobility and model parameter aggregation. However, the peer-to-peer and aggregation architecture of federated learning does not match the specific security scenario of one-way, guided knowledge transfer between internal and external networks, and it faces challenges when dealing with heterogeneous models.

[0006] Therefore, the application innovatively proposes a cross-network collaborative alarm noise reduction method based on a knowledge distillation large model. SUMMARY

[0007] To solve the above problems, the application provides a cross-network collaborative alarm noise reduction method based on a large model of knowledge distillation; the application distills the global threat insight of a first network domain large model and gives it to a lightweight model of a second network domain, thereby reducing the false positives and false negatives of the model of the second network domain due to lack of global vision, and improving the efficiency, accuracy and detection capability of high-level collaborative attacks of alarm noise reduction.

[0008] The technical solution of the application is as follows: the application provides a cross-network collaborative alarm noise reduction method based on a large model of knowledge distillation, which comprises the following steps:

[0009] S1. A server is deployed in a first network domain for running a teacher model; a lightweight device is deployed in a second network domain to be protected for running a student model; and a knowledge distillation module is established as a communication bridge between the two networks;

[0010] S2. In the first network domain, the teacher model is trained using alarm data; after the training is completed, the teacher model starts to process reference alarm data stored in the knowledge distillation module and generates a knowledge data packet;

[0011] S3. The teacher model writes the generated knowledge data packet back to the knowledge distillation module and associates it with the original reference alarm data;

[0012] S4. The student model deployed in the second network domain simultaneously reads the reference alarm data and the corresponding knowledge data packet generated by the teacher model from the knowledge distillation module, and trains the student model based on the read reference alarm data by minimizing a composite loss function;

[0013] S5. After the training is completed, for each new alarm, the student model uses its ability learned through knowledge distillation to perform noise reduction and priority sorting; the student model performs real-time inference in the internal network, while the teacher model analyzes new data in the first network domain and updates the knowledge base.

[0014] Further, the S1 comprises:

[0015] The model parameters and the structure of the model in the first network domain and the second network domain can be the same or different.

[0016] Further, the S2 comprises:

[0017] S21. First, the discrete and unstructured alarm events are converted into an ordered input sequence;

[0018] Each independent alarm event or its key attribute is mapped to a unique integer identifier, i.e., a token;

[0019] The input sequence is first converted into an embedding matrix composed of token embeddings and position embeddings;

[0020] S22. The subject of the teacher model is composed of one or more stacked Transformer encoder layers; each encoder layer contains two core sub-layers: multi-head self-attention mechanism and feed-forward neural network;

[0021] The embedding matrix is linearly projected into three matrices: query Q, key K and value V; the attention score is obtained by calculating the dot product of the query and the key, and is scaled to stabilize the gradient;

[0022] The scaled attention score is then converted into a weight by the softmax function; the final output is the weighted sum of the values, and the core logic formula of the multi-head self-attention sub-layer is scaled dot-product attention :

[0023]

[0024] wherein, is the dimension of the key vector, is the softmax function;

[0025] In addition, the output of each attention sub-layer will pass through a fully connected feed-forward neural network, which is independently applied to each position in the sequence; the output of each attention sub-layer is connected in residual with the input of the attention sub-layer, and then normalized by layer;

[0026] S23. The teacher model is trained and optimized:

[0027] The teacher model is trained on an alarm dataset , wherein, is the alarm sequence, is its corresponding true label, and M is the total number of alarm sequences;

[0028] The goal of training is to minimize the cross-entropy loss function , let be the parameters of the teacher model, then the optimization problem is represented as:

[0029]

[0030] wherein, is the final output of the teacher model for the alarm sequence , and is the cross-entropy function;

[0031] S24. After training, the teacher model processes the reference alarm sequence from the shared repository and generates a knowledge data package;

[0032] Among them, response-based knowledge is the final predicted output of the teacher model, let Let C be the original output of the teacher model for a given alarm sequence, where C represents the total number of threat categories output by the teacher model, which is the number of all possible threat categories when the teacher model classifies the alarm sequence. The formula for calculating the soft target probability vector q is:

[0033]

[0034] in, >1 is the temperature parameter. This soft target probability vector q reveals the confidence distribution and similarity judgment of the teacher model among different threat categories.

[0035] The j-th element of the soft target probability vector q represents the confidence of the teacher model that the current alarm sequence belongs to the j-th threat category;

[0036] The j-th element of the teacher model's original output logits for the current alarm sequence is the original score of the j-th threat category before softmax normalization, reflecting the model's original preference for that category.

[0037] The k-th element of the teacher model's original output for the current alarm sequence, where k iterates through all C threat categories (k=1,2,...,C), is used to calculate the denominator of the softmax normalization, ensuring that q satisfies the condition that the sum of the probabilities of all categories is 1; In this context, j is the threat category index, used to describe the probability values ​​of different categories within a single soft target probability vector;

[0038] In summary, for each reference alarm sequence in the shared repository Knowledge data packages generated by the teacher model Formalized as a tuple containing multiple pieces of knowledge: ;

[0039] in, It is the i-th reference alarm sequence The corresponding complete soft target probability vector, It is a feature embedding vector, and It is one or more attention weight matrices.

[0040] Further, S3 includes:

[0041] The data in the knowledge distillation module is organized into a structured collection, in which each original reference alarm data is explicitly associated with a knowledge data package generated by the teacher model.

[0042] Further, S4 includes:

[0043] A cryptographic model based on digital signatures is used for the transmission and storage of knowledge data packets;

[0044] The teacher model holds a pair of asymmetric keys: a private key. and a public key For each generated knowledge data package The teacher model first uses a standard cryptographic hash function to compute its digest. :

[0045]

[0046] The teacher model then uses its private key. Encrypt the hash digest to generate a digital signature. :

[0047]

[0048] Next, the teacher model will and Encapsulate them to obtain an enhanced knowledge data package The teacher model then adds enhanced knowledge data packages. Write to the knowledge distillation module;

[0049] The student model reads enhanced knowledge data packages from the knowledge distillation module. The student model independently processes the received knowledge data. Calculate its summary :

[0050]

[0051] The student model uses the public key of the teacher model. Digital signatures Perform decryption verification;

[0052]

[0053] Only when Result is true, i.e. When the hash value obtained from decrypting the signature matches exactly, the student model accepts and uses the knowledge data packet. Continue training; if verification fails, discard the data packet.

[0054] By implementing access control policies on the knowledge distillation module, the unidirectional flow of knowledge is enforced at the logical level.

[0055] Define the set of operation permissions related to knowledge transfer:

[0056]

[0057] In the permission-role assignment relationship PA, the following strict constraints are imposed:

[0058] The teacher model is granted the permission to write knowledge:

[0059]

[0060] The student model is granted the permission to read knowledge:

[0061]

[0062] The student model is never granted the permission to write knowledge:

[0063]

[0064] where Role Teacher , Role student represent the teacher model, student model role respectively;

[0065] This set of mathematical permission assignment rules, combined with the aforementioned digital signature-based cryptography model, together build a secure channel that only allows verified abstract knowledge to flow from the first network domain to the second network domain in one direction.

[0066] Further, the S4 further comprises:

[0067] S41. Let the student model be a function defined by a set of learnable parameters ; the student model receives an alert data input x and outputs a set of prediction values :

[0068]

[0069] S42. The training process of the student model is to minimize a composite loss function, which is the weighted sum of at least two component losses;

[0070]

[0071] where is the standard task loss, used to supervise the student model to learn the basic classification task; is the distillation loss, used to force the student model to imitate the output of the teacher model; is a hyperparameter used to balance the importance of the two loss terms;

[0072] S43. The final training goal of the student model is to find a set of optimal parameters such that the composite loss function is minimized;

[0073] .

[0074] Further, the S5 comprises:

[0075] S51. After the training is completed, the optimized student model with parameters is deployed in the second network domain to process real-time alert flows;

[0076] Let be a real-time alert event received from an in-network alert source at time ;

[0077] The student model applies the function it learned through distillation to infer the real-time alert event and generates a predicted output vector :

[0078]

[0079] This predicted output vector is then converted into a probability distribution where belongs to a predefined set of alert categories D;

[0080] S52. Let be the parameter state of the student model at time ; let be the set of knowledge available in the knowledge distillation module at time ;

[0081] Teacher knowledge update: the teacher model independently processes reference alert data and updates the knowledge base, which is represented as the update operation on the knowledge base at discrete time points :

[0082]

[0083] where is a batch of newly generated knowledge by the teacher model; represents the set of knowledge available in the knowledge distillation module at the i-th update time point , is the discrete time point at which the teacher model performs the i-th update on the knowledge base, is the latest set of knowledge in the knowledge distillation module after the i-th update is completed;

[0084] The retraining process of the student model is at discrete time points The student model uses the latest available knowledge at the beginning of the training:

[0085]

[0086] wherein, represent the reference alarm data set used for student model retraining, the basis data for optimizing student model parameters, represent the model parameter state of the student model at the jth training time point after completing the training;

[0087] The student real-time inference is carried out: the real-time inference process of the student model is continuous, and the model parameters after the last training are used:

[0088]

[0089] wherein, is the latest training completion time point less than or equal to t, refers to the alarm decision result.

[0090] The application also provides a cross-network collaborative alarm noise reduction system based on a knowledge distillation large model, which comprises a module for executing the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0091] The application also provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to realize the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0092] The application also provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to realize the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0093] The application has the following beneficial effects:

[0094] Firstly, by establishing an asymmetric teacher-student architecture across the network security boundary, the global threat insight of the first network domain large model is distilled into abstract knowledge and unidirectionally transmitted, thereby reducing the misjudgment risk of the second network domain model due to limited vision, significantly improving the accuracy of alarm noise reduction and the ability to identify complex collaborative attacks;

[0095] Secondly, the application greatly reduces the high consumption of computing and storage resources of key internal devices by deploying a lightweight student model in the second network domain and adopting an asynchronous cooperative operation mode, improves the feasibility of deploying advanced AI capabilities in a resource-constrained environment, effectively avoids performance bottlenecks caused by network delays, and improves the real-time processing efficiency of the system.

[0096] Finally, by constructing a security architecture equivalent to an intelligent knowledge diode, only refined knowledge but not raw data is allowed to flow between networks, thereby fundamentally reducing the risk of sensitive data leakage or external attack penetration, and improving the security isolation level of the entire system. BRIEF DESCRIPTION OF DRAWINGS

[0097] In order to more clearly illustrate the technical solutions in the present application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0098] Figure 1 is a flowchart of a cross-network cooperative alarm noise reduction method based on a knowledge distillation large model provided by the present application;

[0099] Figure 2 is an architecture flowchart of a cross-network cooperative alarm noise reduction method based on a knowledge distillation large model provided by the present application;

[0100] Figure 3 is a structural schematic diagram of an electronic device provided by the present application.

[0101] In the drawings, various reference numerals refer to:

[0102] 310 - processor; 320 - communication interface; 330 - memory; 340 - communication bus. DETAILED DESCRIPTION

[0103] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily without conflict.

[0104] It should be noted that the execution subject of the embodiment of the present application can be various types of terminals, and the terminal can be, for example, a computer, a smart phone, a tablet computer, a wearable device, a personal digital assistant (English: Personal Digital Assistant, abbreviated: PDA), a mobile Internet device (English: Mobile Internet Device, abbreviated: MID), and the like, which can perform text processing, and the present application does not make any limitation thereto.

[0105] Embodiment 1: As shown in the present application, the embodiment provides a cross-network collaborative alarm noise reduction method based on knowledge distillation, which comprises: Figure 1

[0106] S1. A server is deployed in a first network domain for running a teacher model; a lightweight device is deployed in a second network domain to be protected for running a student model; a knowledge distillation module is established to serve as a communication bridge between the two networks;

[0107] In some feasible embodiments, the S1 comprises:

[0108] The model parameters and the structure of the model in the first network domain and the second network domain can be the same or different.

[0109] S2. In the first network domain, the teacher model is trained using alarm data; after the training is completed, the teacher model starts to process the reference alarm data stored in the knowledge distillation module and generates a knowledge data package;

[0110] In the first network domain, the goal of training the teacher model using alarm data is to enable the teacher model to learn the deep and generalization ability to distinguish between real threats and noise;

[0111] In some feasible embodiments, the S2 comprises:

[0112] S21. To process alarm data using a Transformer model, first convert discrete and unstructured alarm events into an ordered input sequence;

[0113] Map each independent alarm event or its key attribute (such as alarm type, source IP, target port, timestamp, etc.) to a unique integer identifier, i.e., a token;

[0114] The Transformer model cannot directly process tokens, so the input sequence is first converted into an embedding matrix wherein is the hidden dimension of the model, and the embedding matrix is composed of token embedding and position embedding; ​

[0115] S22. The main body of the teacher model is composed of one or more stacked Transformer encoder layers; each encoder layer contains two core sub-layers: multi-head self-attention mechanism and feed-forward neural network; allowing the model to weigh the importance of all other tokens in the sequence when processing each token in the sequence;

[0116] The embedding matrix is linearly projected into three matrices: query Q, key K and value V; the attention score is obtained by calculating the dot product of the query and the key, and is scaled to stabilize the gradient;

[0117] The scaled attention score is then converted into a weight by the softmax function; the final output is the weighted sum of the values, and the core logic formula of the multi-head self-attention sub-layer is scaled dot-product attention :

[0118]

[0119] wherein, is the dimension of the key vector, is the softmax function;

[0120] In addition, the output of each attention sub-layer will pass through a fully connected feed-forward neural network, which is independently applied to each position in the sequence; the output of each attention sub-layer is connected in residual with the input of the attention sub-layer, and then layer normalization is performed;

[0121] S23. The teacher model is trained and optimized:

[0122] The teacher model is trained on an alarm dataset , wherein, is the alarm sequence, is its corresponding true label, and M is the total number of alarm sequences;

[0123] The goal of training is to minimize the cross-entropy loss function , let be the parameters of the teacher model, then the optimization problem is represented as:

[0124]

[0125] wherein, is the final output of the teacher model for the alarm sequence , and is the cross-entropy function;

[0126] S24. After training, the teacher model processes the reference alarm sequences from the shared repository and generates knowledge data packages; for the Transformer architecture, the extractable knowledge is particularly rich, including response-based knowledge, feature-based knowledge, and relation-based knowledge, etc.

[0127] Among them, response-based knowledge is the final predicted output of the teacher model, let Let C be the original output of the teacher model for a given alarm sequence, where C represents the total number of threat categories output by the teacher model, which is the number of all possible threat categories when the teacher model classifies the alarm sequence. The formula for calculating the soft target probability vector q is:

[0128]

[0129] in, >1 is the temperature parameter. This soft target probability vector q reveals the confidence distribution and similarity judgment of the teacher model among different threat categories.

[0130] The j-th element of the soft target probability vector q represents the confidence of the teacher model that the current alarm sequence belongs to the j-th threat category;

[0131] The j-th element of the teacher model's original output logits for the current alarm sequence is the original score of the j-th threat category before softmax normalization, reflecting the model's original preference for that category.

[0132] The k-th element of the teacher model's original output for the current alarm sequence, where k iterates through all C threat categories (k=1,2,...,C), is used to calculate the denominator of the softmax normalization, ensuring that q satisfies the condition that the sum of the probabilities of all categories is 1; In this context, j is the threat category index, used to describe the probability values ​​of different categories within a single soft target probability vector;

[0133] In summary, for each reference alarm sequence in the shared repository Knowledge data packages generated by the teacher model Formalized as a tuple containing multiple pieces of knowledge: ;

[0134] in, It is the i-th reference alarm sequence The corresponding complete soft target probability vector, It is a feature embedding vector, and is one or more attention weight matrices, this structured data package is then stored in the knowledge distillation module, providing comprehensive and profound guidance for the distillation training of the student model.

[0135] S3. The teacher model writes the generated knowledge data package back to the knowledge distillation module and associates it with the original reference alarm data;

[0136] The above processing mode ensures that only highly refined and abstracted knowledge can flow unidirectionally from the first network domain to the second network domain, without transmitting any original and potentially harmful external data;

[0137] In some possible implementations, the S3 includes:

[0138] The data in the knowledge distillation module is organized as a structured set, in which each original reference alarm data is explicitly associated with the knowledge data package generated by the teacher model.

[0139] S4. The student model deployed in the second network domain simultaneously reads the reference alarm data and the corresponding knowledge data package generated by the teacher model from the knowledge distillation module, and trains the student model based on the read reference alarm data by minimizing the composite loss function;

[0140] The training goal of the student model is to imitate the thinking process of the teacher model; in this way, the student model effectively absorbs the wisdom and experience of the teacher model without directly accessing massive external data.

[0141] In some possible implementations, the S4 includes:

[0142] To ensure the security of the knowledge data package transferred from the first network domain to the second network domain during transmission and storage, and to ensure that it indeed comes from a legitimate teacher model, the present application adopts a cryptography model based on digital signature for the transmission and storage of the knowledge data package;

[0143] The teacher model holds a pair of asymmetric keys: a private key and a public key ; for each generated knowledge data package , the teacher model first calculates its digest using a standard cryptography hash function:

[0144]

[0145] Then, the teacher model encrypts the hash digest using its private key to generate a digital signature :

[0146]

[0147] Then, the teacher model will and package the enhanced knowledge data package , the teacher model will write the enhanced knowledge data package to the knowledge distillation module;

[0148] The student model reads the enhanced knowledge data package from the knowledge distillation module; the student model independently calculates the summary of the received knowledge data part :

[0149]

[0150] The student model uses the public key of the teacher model to decrypt and verify the digital signature ;

[0151]

[0152] Only when Result is true, i.e. the decrypted signature and the hash value are exactly matched, the student model accepts and uses the knowledge data package for subsequent training; if the verification fails, the data package is discarded;

[0153] By implementing access control policies on the knowledge distillation module, the one-way flow of knowledge is enforced at the logical level;

[0154] Define a set of operation permissions related to knowledge transfer:

[0155]

[0156] In the permission-role assignment relationship PA, the following strict constraints are imposed:

[0157] The teacher model is granted the permission to write knowledge:

[0158]

[0159] The student model is granted the permission to read knowledge:

[0160]

[0161] The student model is never granted the permission to write knowledge:

[0162]

[0163] Where Role Teacher , Role​student Teacher model, student model, respectively, represent the role of the teacher model, the student model;

[0164] This set of mathematical rules of permission assignment, combined with the aforementioned digital signature-based cryptography model, together build a secure channel that only allows verified abstract knowledge to flow from the first network domain to the second network domain in one direction.

[0165] In some possible implementations, the S4 further includes:

[0166] S41. Let the student model be a function defined by a set of learnable parameters ; the student model receives an alert data input x and outputs a set of prediction values :

[0167]

[0168] The architecture of the student model is designed to be lightweight, with both the number of parameters and the computational complexity being significantly lower than that of the teacher model;

[0169] S42. The training process of the student model is to minimize a composite loss function, which is the weighted sum of at least two component losses, with the goal of achieving two goals simultaneously: learning to solve the basic task, and imitating the thinking process of the teacher model;

[0170]

[0171] where, is the standard task loss, used to supervise the student model to learn the basic classification task; is the distillation loss, used to force the student model to imitate the output of the teacher model; is a hyperparameter used to balance the importance of the two loss terms;

[0172] S43. The final training goal of the student model is to find a set of optimal parameters that minimizes the composite loss function ;

[0173] .

[0174] S5. After training, for each new alert, the student model uses its ability learned through knowledge distillation to perform noise reduction and priority sorting; the student model performs real-time inference in the internal network, while the teacher model analyzes new data and updates the knowledge base in the first network domain.

[0175] In some possible implementations, the S5 includes:

[0176] S51. After the training is completed, the optimized student model , whose parameters are deployed in the second network domain (secure internal network) to process real-time alarm flows;

[0177] Let be a real-time alarm event received from an internal network alarm source at time ;

[0178] The student model applies the function it has learned through distillation to infer the real-time alarm event and generate a predicted output vector :

[0179]

[0180] This predicted output vector is then converted into a probability distribution , where belongs to a predefined set of alarm categories D;

[0181] The system architecture of the present application is asynchronous in design to decouple the operations of the internal and external networks, thereby being robust to network latency. This is in sharp contrast to synchronous distributed systems (such as traditional federated learning), whose performance will be severely degraded due to high communication latency.

[0182] S52. Let be the parameter state of the student model at time ; let be the set of knowledge available in the knowledge distillation module at time ; the teacher knowledge generation, student model training, and student real-time inference are decoupled in time;

[0183] Teacher knowledge update: the teacher model independently processes the reference alarm data and updates the knowledge base, which is represented as updating the knowledge base at discrete time points The update operation on the knowledge base is:

[0184]

[0185] where is a batch of newly generated knowledge by the teacher model; represents the set of knowledge available in the knowledge distillation module at the i-th update time point , is the discrete time point at which the teacher model performs the i-th update on the knowledge base, is the latest set of knowledge in the knowledge distillation module after the i-th update is completed;

[0186] The retraining (or distillation) process of the student model is performed at discrete time points The student model uses the latest available knowledge at the start of training.

[0187]

[0188] in, This represents the reference alert dataset used for retraining the student model, serving as the foundational data for optimizing the student model parameters. The student model at training time j The state of the corresponding model parameters after training is complete;

[0189] Real-time inference for students: The real-time inference process of the student model is continuous, using the model parameters from the most recently trained model.

[0190]

[0191] in, It is the most recent training completion time point that is less than or equal to t. This refers to the alarm decision result.

[0192] The present invention also provides a cross-network collaborative alarm noise reduction system based on a knowledge distillation large model, the system including a module for executing the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0193] This invention also provides an electronic device. Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include a processor 310, a communications interface 320, a memory 330, and a communication bus 340. The processor 310, communications interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions from the memory 330 to execute the aforementioned cross-network collaborative alarm noise reduction method based on a knowledge distillation large-scale model.

[0194] In addition, the logical instructions in the memory 330 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0195] The embodiment of the present application also provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0196] The embodiment of the present application also provides a computer program product, and the computer program product includes a computer program, and the computer program is executed by a processor to realize the cross-network collaborative alarm noise reduction method based on the knowledge distillation large model.

[0197] The core innovation of the present application is its unique, asymmetric knowledge distillation framework across network security domains, which abandons the traditional paradigm of isolating AI models within a single network or performing peer-to-peer aggregation in federated learning.

[0198] By introducing a novel "teacher-student" knowledge transfer mechanism at the system architecture level, the method functionally constructs an intelligent "knowledge diode": a powerful teacher model deployed in the first network domain with a global view, responsible for learning and refining highly abstract threat patterns and alarm noise reduction logic from massive data. Subsequently, these refined "knowledge" that is not original data flows in a one-way, irreversible manner to the second network domain, guiding lightweight student models.

[0199] This model-fixed, knowledge-flowing architecture fundamentally differs from the symmetric aggregation mode of federated learning, where data is fixed and models flow. It not only solves the problem of insufficient noise reduction capability of the second network domain model due to limited "vision", but also avoids the security risks brought by directly transmitting original data across networks, ultimately achieving a breakthrough balance between ensuring high-level security isolation and realizing high-level intelligent analysis capability.

[0200] In order to illustrate the effect of the present application, the present application is compared and illustrated from the following aspects, and the results are shown in Table 1.

[0201] Table 1: Comparison of automation degree and advantages and disadvantages of different methods

[0202]

[0203] Through the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course, can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0204] The above description can be implemented individually or in various combinations, and these variations are within the protection scope of the present application.

[0205] It should be noted that in the present application, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the term "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that the article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such article or device. Without more limitations, the elements defined by the statement "comprising" do not exclude the presence of other identical elements in the article or device including the elements.

[0206] The above embodiments are only used to illustrate the technical solutions of the present application and not to limit, and the present application has been described in detail only by referring to the preferred embodiments. Those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present application, and all should be covered in the scope of the claims of the present application.

Claims

1. A cross-network collaborative alarm noise reduction method based on a large model of knowledge distillation, characterized by: The method comprises: S1. Deploy a server in a first network domain for running a teacher model; deploy a lightweight device in a second network domain for running a student model; and establish a knowledge distillation module as a communication bridge between the two networks; S2. In the first network domain, use the alarm data to train the teacher model; after the training is completed, the teacher model starts to process the reference alarm data stored in the knowledge distillation module and generates a knowledge data package; S3. The teacher model writes the generated knowledge data package back to the knowledge distillation module and associates it with the original reference alarm data; S4. The student model deployed in the second network domain reads the reference alarm data and the corresponding knowledge data package generated by the teacher model from the knowledge distillation module at the same time, and trains the student model based on the read reference alarm data by minimizing the composite loss function; S5. After the training is completed, for each new alarm, the student model uses its ability learned through knowledge distillation to perform noise reduction and priority sorting; the student model performs real-time inference in the intranet, while the teacher model analyzes new data and updates the knowledge base in the first network domain; The S5 comprises: S51. After the training is completed, the optimized student model with parameters is deployed in the second network domain to process real-time alarm flows; Let To time A real-time alarm event received from an Intranet alarm source; The student model applies the functions it learned through distillation to reason about the real-time alert event, generating a predicted output vector : ； This predicted output vector is then converted into a probability distribution wherein belongs to a predefined set of alarm categories D; S52. Let be the parameter state of the student model at time ; let be the set of knowledge available in the knowledge distillation module at time ; Teacher knowledge update: The teacher model independently processes the reference alarm data and updates the knowledge base, this process is represented as at discrete time points Update operation on the knowledge base: ； wherein, is a new batch of knowledge newly generated by the teacher model; represents the set of knowledge available in the knowledge distillation module at the i-th update time point , is the discrete time point at which the i-th update of the knowledge base by the teacher model is performed, is the latest set of knowledge in the knowledge distillation module after the i-th update is completed; The retraining process of the student model takes place at discrete points in time ; the student model uses the most up-to-date knowledge available at the start of the training: ； wherein, representing the reference alarm data set used for the student model retraining, the base data for optimizing the student model parameters, representing the student model at the jth training time point the corresponding model parameter state after the training is completed; Student real-time inference: the real-time inference process of the student model is continuous, and it uses the model parameters of the last training completion: ； wherein, is the last training completion time point less than or equal to t, is referred to as the alarm decision result.

2. The cross-network cooperative alarm noise reduction method based on the knowledge distillation large model according to claim 1, characterized in that: The S1 comprises: The model parameters and the structure of the model in the first network domain and the second network domain can be the same or different.

3. The cross-network cooperative alarm noise reduction method based on the large model of knowledge distillation according to claim 1, characterized in that: The S2 comprises: S21. First, convert discrete and unstructured alarm events into an ordered input sequence; Map each independent alarm event or its key attribute to a unique integer identifier, i.e., a token; The input sequence is first converted into an embedding matrix, which is composed of token embedding and position embedding; S22. The main body of the teacher model is composed of one or more stacked Transformer encoder layers; each encoder layer contains two core sub-layers: multi-head self-attention mechanism and feed-forward neural network; The embedding matrix is linearly projected into three matrices: query Q, key K and value V; the attention score is obtained by calculating the dot product of the query and the key, and is scaled to stabilize the gradient; The scaled attention scores are then converted into weights by a softmax function; the final output is a weighted sum of values, and the core logic formula of the multi-head self-attention sublayer is scaled dot-product attention : ； wherein, is the dimension of the key vector, is a softmax function; In addition, the output of each attention sub-layer will pass through a fully connected feed-forward neural network, which is independently applied to each position in the sequence; the output of each attention sub-layer is connected in residual with the input of the attention sub-layer, and then normalized by layer; S23. Training optimization of the teacher model: Teacher model is trained on a set of alert data wherein, is a sequence of alerts, is its corresponding true label, and M is the total number of sequences of alerts; The goal of the training is to minimize the cross-entropy loss function , where are the parameters of the teacher model, the optimization problem is expressed as: ； wherein, is the final output of the teacher model on the alarm sequence , is the cross-entropy function; S24. After the training is completed, the teacher model processes the reference alarm sequence from the shared repository and generates a knowledge data package; where is the final prediction output of the teacher model, and is the original output of the teacher model for a certain alarm sequence, where C represents the total number of threat categories output by the teacher model, is the number of all possible threat categories when the teacher model classifies the alarm sequence, and the calculation formula of the soft target probability vector q is: ； wherein, >1 is a temperature parameter, this soft target probability vector q reveals the confidence distribution and similarity judgment of the teacher model among different threat categories; : the jth element of the soft target probability vector q, representing the teacher model's confidence that the current alert sequence belongs to the jth threat class; : The jth element of the raw output logits of the teacher model for the current alarm sequence, which is the raw score of the jth threat category without softmax normalization, reflecting the raw preference of the model for this category. : the k-th element of the raw output of the teacher model for the current alarm sequence, where k iterates over all C threat classes (k = 1, 2,..., C) for computing the denominator of the softmax normalization, ensuring that q satisfies the sum of all class probabilities to be 1; j in is the threat class index, used to describe the probability values of different classes inside a single soft target probability vector; In summary, for each reference alarm sequence in the shared repository , the knowledge data package generated by the teacher model is formally defined as a tuple containing multiple kinds of knowledge: ; wherein, is the i-th reference alarm sequence the corresponding full soft target probability vector, is the feature embedding vector, and is one or more matrices of attention weights.

4. The cross-network cooperative alarm noise reduction method based on the large model of knowledge distillation according to claim 1, characterized in that: The S3 comprises: The data in the knowledge distillation module is organized as a structured set, in which each original reference alarm data is explicitly associated with the knowledge data package generated by the teacher model.

5. The cross-network cooperative alarm noise reduction method based on the large model of knowledge distillation according to claim 1, characterized in that: The S4 comprises: A digital signature-based cryptography model is used for knowledge data package transmission and storage; The teacher model holds a pair of asymmetric keys: a private key and a public key ; for each generated knowledge packet , the teacher model first computes its digest using a standard cryptographic hash function : ； Subsequently, the teacher model uses its private key The hash digest is encrypted, generating a digital signature : ； Next, the teacher model will and encapsulate to get an enhanced knowledge data packet , the teacher model will write the enhanced knowledge data packet to the knowledge distillation module; The student model reads the augmented knowledge data package from the knowledge distillation module ; the student model independently processes the received knowledge data portion computes its summary : ； The student model uses the public key of the teacher model To digitally sign Decrypt verification; ； Only if Result is true, i.e. the student model accepts and uses the knowledge packet if the decrypted signature exactly matches the hash value obtained from the signature for subsequent training; if the verification fails, the packet is discarded; By implementing access control strategies on the knowledge distillation module, the unidirectional flow of knowledge is forcibly implemented at the logical level; Define a set of operation permissions related to knowledge transmission: ； In the permission-role assignment relationship PA, the following strict constraints are imposed: The teacher model is granted the permission to write knowledge: ； The student model is granted the permission to read knowledge: ； The student model is never granted the permission to write knowledge: ； wherein Role Teacher , Role student respectively represent the teacher model, student model role; This set of mathematical permission assignment rules, combined with the cryptography model based on digital signatures, jointly build a secure channel that only allows verified abstract knowledge to flow from the first network domain to the second network domain in one direction.

6. The cross-network cooperative alarm noise reduction method based on a large knowledge distillation model according to claim 1, characterized in that: The S4 further comprises: S41. Let the student model be a function defined by a set of learnable parameters ; the student model receives an alert data input x and outputs a set of predictions : ； S42. The training process of the student model is to minimize a composite loss function, which is a weighted sum of at least two component losses; ; wherein, is a standard task loss used to supervise the student model to learn the basic classification task; is a distillation loss used to force the student model to mimic the output of the teacher model; is a hyper-parameter used to balance the importance of the two loss terms; S43. The final training goal of the student model is to find a set of optimal parameters such that the composite loss function is minimized; 。 7. A cross-network collaborative alarm noise reduction system based on a large model of knowledge distillation, characterized by, The system comprises a module for performing the knowledge distillation-based large model cross-network collaborative alarm noise reduction method according to any one of claims 1-6.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the knowledge distillation-based large model cross-network collaborative alarm noise reduction method according to any one of claims 1-6 when executing the program.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the knowledge distillation-based large model cross-network collaborative alarm noise reduction method according to any one of claims 1-6.

Images