Threat intelligence guided confrontation knowledge distillation detection method

Abstract

The invention discloses an adversarial knowledge distillation detection method guided by threat intelligence, relates to the technical field of network security protection, and solves the problems of low detection accuracy and defense lagging of novel network attacks in the prior art. According to the embodiment of the invention, the alarm frequency is converted into the multi-scale Grubrum angle field image features, attack features under different time scales can be captured, a cross-time-dimension complex attack chain and hidden association can be visually recognized, the missing report rate is reduced, and the detection capability of unknown variant attacks and low-frequency slow attacks is improved. Under the condition that novel threat intelligence is obtained, a targeted first training sample is generated in combination with a multi-scale Gramer angle field image, and first adversarial training of a student model is quickly triggered, so that the detection capability of novel attacks is accurately improved, and the problem of defense lag is improved.

Description

Technical Field

[0001] This invention relates to the field of network security protection technology, and in particular to a threat intelligence-guided adversarial knowledge distillation detection method. Background Technology

[0002] With the acceleration of digitalization, cyberspace has become a crucial carrier for core areas such as critical infrastructure, financial services, and government systems. However, the security threats it faces are exhibiting significant characteristics of complexity, diversification, and dynamism. In particular, the iteration speed of various malicious attack techniques continues to accelerate. Attackers are constantly circumventing existing defense systems by modifying known attack methods, such as code obfuscation, payload mutation, and attack path reconstruction, causing traditional signature-based defense methods to gradually become ineffective. Against this backdrop, cybersecurity defense models based on Artificial Intelligence (AI) technology, due to their self-learning and pattern recognition capabilities, have become a core technological direction for addressing unknown threats.

[0003] Existing AI models require massive amounts of training data to detect various attacks. For attack variants not included in the training data, detection accuracy drops significantly, necessitating frequent retraining to maintain defense effectiveness. The retraining process for existing AI models is lengthy, while the emergence cycle of new cyberattack variants is short. Under these circumstances, defense systems are chronically in a reactive, "passive" state, unable to respond promptly to new attacks, resulting in extremely high security risks to critical information assets.

[0004] Therefore, a threat intelligence-guided adversarial knowledge distillation detection method is needed. Summary of the Invention

[0005] To address the issues of low detection accuracy and lagging defense against novel cyberattacks in existing technologies, this invention provides a threat intelligence-guided adversarial knowledge distillation detection method, which can improve the detection accuracy of unknown attack behaviors and alleviate defense lag. The specific technical solution is as follows: In a first aspect, embodiments of this application provide a threat intelligence-guided adversarial knowledge distillation detection method, the method comprising: The process involves: acquiring alarm data and threat intelligence; generating multi-scale Gram-field image features based on the time-series data of alarm frequencies; training a teacher model and a student model based on these multi-scale Gram-field image features; wherein the inputs of both the teacher model and the student model include the multi-scale Gram-field image features, and the outputs of both models are probability distributions of attack behavior types; generating enhanced image features containing novel attack features based on the threat intelligence and the multi-scale Gram-field image features; wherein these novel attack features are obtained based on the threat intelligence; performing first adversarial training on the student model using a first generative adversarial network (GAN) based on the enhanced image features; wherein the generator of the first GAN is used to generate first training samples based on the enhanced image features; and the discriminator of the first GAN is used to determine whether the first training samples input to the teacher model and the student model are real samples or generated samples based on the first output data of the teacher model and the student model; and detecting network attack behavior using the student model trained through the first adversarial training.

[0006] Preferably, the training of the teacher model and the student model based on the multi-scale Gram field image features includes: performing adversarial training on the teacher model and the student model based on the multi-scale Gram field image features through a second generative adversarial network; the generator of the second generative adversarial network is used to generate the second training samples based on the multi-scale Gram field image features, and the discriminator of the second generative adversarial network is used to determine whether the second training samples input to the teacher model and the student model are real samples or generated samples based on the second output data of the teacher model and the student model.

[0007] Preferably, generating multi-scale Gram angle field image features based on the time-series data of alarm frequencies in the alarm data includes: statistically analyzing the alarm frequencies at different time granularities to generate alarm frequency sequences at multiple time scales; performing polar coordinate normalization on the alarm frequency sequences at each time scale and mapping the element values ​​in the alarm frequency sequences to polar angles; calculating the Gram angle field matrix based on the polar angles to generate corresponding image features; and concatenating the image features at multiple time scales along the channel dimension to obtain the multi-scale Gram angle field image features.

[0008] Preferably, the process of generating enhanced image features containing novel attack features based on the threat intelligence and the multi-scale Gram field image features includes: generating the novel attack features based on the attack patterns and attack behavior features in the threat intelligence; projecting the novel attack features onto the same dimension as the multi-scale Gram field image features to obtain attack projection features; and adding or multiplying the multi-scale Gram field image features and the attack projection features to generate the enhanced image features.

[0009] Preferably, the input of the student model also includes semantic embedding features, which are generated based on the alarm fields in the alarm data. The student model includes a semantic input branch, an image input branch, and a gated fusion layer. The gated fusion layer is used to fuse the output of the semantic input branch and the output of the image input branch to obtain fused features.

[0010] Preferably, the student model further includes a classification layer; the first adversarial training of the student model based on the enhanced image features includes: selecting the core parameters of the student model through the Elastic Weights Integration (EWC) algorithm; during the first adversarial training, the core parameters of the semantic input branch and the image input branch remain unchanged, the core parameters of the gated fusion layer are updated with a first learning rate, and the core parameters of the classification layer are updated with a second learning rate, wherein the first learning rate is less than the second learning rate; during the first adversarial training, the loss function of the student model includes a knowledge distillation loss term and an elastic weights consolidation regularization loss term, wherein the knowledge distillation loss term is used to penalize the output difference between the student model and the teacher model based on the first training sample, the output difference is proportional to the knowledge distillation loss term, and the elastic weights consolidation regularization loss term is proportional to the adjustment magnitude of the core parameters.

[0011] Preferably, the loss function of the generator of the first generative adversarial network includes an adversarial loss term and an attack loss term. The adversarial loss term is inversely proportional to the probability that the discriminator of the first generative adversarial network determines the generated sample as a real sample, and the attack loss term is inversely proportional to the output difference.

[0012] Secondly, embodiments of this application provide a threat intelligence-guided adversarial knowledge distillation detection system, applied to the method described in the first aspect, the system comprising: The acquisition module is used to acquire alarm data and threat intelligence; The first generation module is used to generate multi-scale Gram angle field image features based on the time-series data of alarm frequency in the alarm data. The first training module is used to train the teacher model and the student model based on the multi-scale Gram field image features; wherein the input of the teacher model and the student model both include the multi-scale Gram field image features, and the output of the teacher model and the student model are both probability distributions of attack behavior types; The second generation module is used to generate enhanced image features containing novel attack features based on the threat intelligence and the multi-scale Gram field image features; wherein the novel attack features are obtained based on the threat intelligence; The second training module is used to perform first adversarial training on the student model based on the enhanced image features through the first generative adversarial network; wherein, the generator of the first generative adversarial network is used to generate first training samples based on the enhanced image features; the discriminator of the first generative adversarial network is used to determine whether the first training samples input to the teacher model and the student model are real samples or generated samples based on the first output data of the teacher model and the student model. The detection module is used to detect network attack behavior through the student model trained by the first adversarial approach.

[0013] Thirdly, embodiments of this application provide a computing device, including: a memory for storing a program; and a processor for loading the program to execute the method as described in the first aspect.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium including a stored program, wherein the program, when running, controls the device where the computer-readable storage medium is located to perform the method described in the first aspect.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: by converting alarm frequencies into multi-scale Gram field image features, it is possible to capture attack features at different time scales, intuitively identify complex attack chains and hidden correlations across time dimensions, reduce false negative rates, and improve the detection capability for unknown variant attacks and low-frequency, slow attacks. When acquiring new threat intelligence, it combines multi-scale Gram field images to generate targeted first training samples and quickly triggers the first adversarial training of the student model, thereby achieving a precise improvement in the detection capability for new attacks and addressing the problem of defense lag. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 A flowchart illustrating a threat intelligence-guided adversarial knowledge distillation detection method provided in this application embodiment; Figure 2 A system architecture diagram of a threat intelligence-guided adversarial knowledge distillation detection system provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0020] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0021] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0022] To address the problem that existing technologies struggle to accurately reconstruct the causal chain in attack events, this invention provides a threat intelligence-guided adversarial knowledge distillation detection method that can accurately reconstruct the causal chain in attack events.

[0023] Please see Figure 1 , Figure 1 This application provides a flowchart illustrating a threat intelligence-guided adversarial knowledge distillation detection method, which is applied to a computing device. Figure 1 As shown, the method includes: Step 101: The computing device acquires alarm data and threat intelligence.

[0024] The computing device can be a server or a terminal, connected to the communication network. Alarm data is structured or semi-structured information automatically generated by communication network devices, systems, or monitoring tools when abnormal events or faults are detected. Threat intelligence is structured knowledge formed by collecting, analyzing, and refining potential and actual network threats within the communication network.

[0025] Specifically, the computing device can communicate with security protection devices in the communication network to directly obtain alarm data; it can also obtain alarm data from the data storage server of the communication network.

[0026] The alarm data is historical alarm data. The computing device will use this historical alarm data as training data and the attack behavior type corresponding to this historical alarm data as a label to train the newly constructed teacher model and student model in subsequent steps.

[0027] For example, the alarm data specifically includes fields such as timestamp, source IP, destination IP, protocol type, alarm level, and description text.

[0028] Threat intelligence is intelligence about new types of attack behaviors. It is used to quickly train student models that have been trained on alert data and have conventional attack detection capabilities. This enables the student models to quickly learn the characteristics of new attack behaviors and acquire the ability to detect new attack behaviors as quickly as possible, thereby improving the lag in security defense.

[0029] Specifically, computing devices can obtain threat intelligence from standardized intelligence platforms, publicly available intelligence channels, and internal security operations centers.

[0030] Specifically, the threat intelligence includes the target of the attack, the attack behavior, and the contextual information of the target business corresponding to the attack behavior.

[0031] It is understandable that before training the teacher model and student model in this embodiment, the computing device can acquire massive amounts of historical alarm data and threat intelligence to train the teacher model and student model; afterwards, the computing device can periodically acquire new alarm data and use the new alarm data to incrementally train the teacher model and student model; when new threat intelligence appears, the new threat intelligence is immediately acquired to quickly train the student model.

[0032] Step 102: The computing device generates multi-scale Gram angle field image features based on the time-series data of alarm frequency in the alarm data.

[0033] The computing device can generate time-series data of alarm frequency by statistically analyzing the timestamps in the alarm data.

[0034] Specifically, the computing device can count the number of alarms at fixed time intervals to form an alarm frequency sequence, thus generating the time-series data.

[0035] Preferably, the computing device can statistically analyze the alarm frequency at different time granularities to generate alarm frequency sequences at multiple time scales; perform polar coordinate normalization on the alarm frequency sequence at each time scale, and map the element values ​​in the alarm frequency sequence to polar angles; calculate the Gram angle field matrix based on the polar angles to generate image features corresponding to the alarm frequency sequences; and stitch the image features corresponding to multiple alarm frequency sequences together in the channel dimension to obtain the multi-scale Gram angle field image features.

[0036] Polar coordinate normalization includes normalization calculation and scaling calculation. The formula for normalization calculation includes: ; in, These are the time series values ​​of the normalized sequence. The median of the sequence. The interquartile range of the sequence. To prevent division by zero of constants.

[0037] The scaling calculation formula includes: ; in, These are scaled timing values. , These are the minimum and maximum values ​​in the normalized time series, respectively. This scaling calculation is used to scale the time series values ​​to the [0,1] interval.

[0038] Specifically, the computing device can calculate the corresponding polar angle and polar radius for the scaled time series values. Specifically, the computing device uses an inverse cosine function to calculate the scaled time series values. Convert to polar angle Through calculation formula Convert the time position of the time series value into a polar radius, where... The polar radius corresponding to the time series value i. is the time index, and N is the sequence length.

[0039] Among them, the alarm frequency sequences of multiple time scales have the same length, which is N, where N is a positive integer greater than 1.

[0040] The computing device uses the polar angle and polar radius corresponding to the time-series values ​​as polar coordinates to generate a Gramian Angular Field Matrix (GAF); the GAF is an N×N matrix, and the matrix elements... The calculation formulas include: .

[0041] Preferably, the multiple time scales include a 1-minute time interval, a 5-minute time interval, and a 30-minute time interval, which are used to capture the instantaneous burst pattern, the sustained attack pattern, and the periodic attack pattern of the attack behavior, respectively.

[0042] By converting alarm frequencies into multi-scale gram field image features, it is possible to capture attack features at different time scales, enabling the trained model to intuitively identify complex attack chains and hidden associations across time dimensions, reduce false negative rates, and improve the detection capability of unknown variant attacks and low-frequency slow attacks.

[0043] Step 103: The computing device trains the teacher model and the student model based on the features of the multi-scale Gram angle field image.

[0044] The computing device can build the teacher model and student model in advance, or it can build these two models after step 102.

[0045] Specifically, the computing device can construct a teacher model using a deep residual network ResNet-18 as its architecture. This teacher model comprises four residual block groups with output channel numbers of 64, 128, 256, and 512 respectively. Each residual block group includes two residual blocks. A convolutional attention module is inserted after each residual block to calculate channel importance weights and spatial location attention weights. Then, feature maps at different levels are extracted from the four residual block groups and fused through a feature pyramid network to enhance the recognition of multi-scale attack patterns.

[0046] Specifically, the formula for calculating the importance weight of a channel includes: ; in, Let F be the importance weight of channel c, and let F be the output feature map of the residual block before the convolutional attention module. For average pooling operation, For max pooling operations, MLP stands for Multilayer Perceptron.

[0047] Specifically, the formula for calculating the attention weights for spatial location includes: ; in, This indicates that a 7×7 convolution operation is performed on the concatenated feature map. () is the Sigmoid activation function.

[0048] The aforementioned importance weights are used in subsequent calculations of the model.

[0049] In this way, the trained teacher network can learn the visual patterns corresponding to different attack behaviors, thereby enabling it to guide student models.

[0050] The computing device can employ a lightweight convolutional network as the image processing part of the student model. Specifically, this lightweight convolutional network includes an initial fully convolutional layer, an inverse residual bottleneck block, and a global average pooling layer. The initial fully convolutional layer contains 32 3×3 convolutional kernels with a stride of 2. The inverse residual bottleneck block contains 6 bottleneck blocks with a spread factor of 6, and the output channels are 16, 24, 32, 64, 96, and 160 respectively. The global average pooling layer is used to output a 320-dimensional image feature vector.

[0051] The inputs to both the teacher model and the student model include the multi-scale Gram angle field image features, and the outputs of both the teacher model and the student model are probability distributions of attack behavior types.

[0052] Preferably, the input of the student model also includes semantic embedding features, which are generated based on the alarm fields in the alarm data. The student model includes a semantic input branch, an image input branch, and a gated fusion layer. The gated fusion layer is used to fuse the output of the semantic input branch and the output of the image input branch to obtain fused features.

[0053] The computing device can standardize the alarm fields, including unifying case conversion, standardizing protocol names and IP addresses, removing special characters and redundant spaces, and obtaining a standardized alarm text sequence; then, it generates the semantic embedding feature through an adaptive pre-trained BERT model in the field of power industrial control.

[0054] Preferably, the computing device can perform adversarial training on the teacher model and the student model based on the multi-scale Gram angular field image features through a second generative adversarial network.

[0055] The generator of the second generative adversarial network is used to generate the second training sample based on the multi-scale Gram corner field image features, and the discriminator of the second generative adversarial network is used to determine whether the second training sample input to the teacher model and the student model is a real sample or a generated sample based on the second output data of the teacher model and the student model.

[0056] It is understandable that semantic features are discrete, abstract, and exist in a high-dimensional semantic space. If perturbations are directly added to the embedding vector, the generated adversarial examples may not correspond to any meaningful, real warning text, i.e., generating "semantically meaningless" noise. This would cause adversarial training to deviate from the real threat scenario. Therefore, the generator only generates adversarial examples for GAF images.

[0057] The second training sample includes the multi-scale Gram field image features themselves, i.e., real samples, as well as generated samples based on the multi-scale Gram field image features.

[0058] The computing device can first train the teacher model based on the second training sample; then, based on the trained teacher model, output a soft probability distribution for each second training sample; then input the second training sample and the corresponding soft probability distribution into the student model for training, calculate the Kalman-Leibler (KL) divergence between the probability distributions output by the teacher model and the student model; and then calculate the knowledge distillation loss of the student model based on the KL divergence to adjust the parameters of the student model.

[0059] The computing device can then train the generator, discriminator, and student model alternately, evaluate the student model's performance after each round of training, and save the optimal parameter configuration.

[0060] Specifically, the loss parameters of the student model include the knowledge distillation loss term, the cross-entropy loss term, and the cross-modal consistency loss term. The knowledge distillation loss term is proportional to the KL divergence, the cross-entropy loss term is inversely proportional to the output accuracy of the student model, and the cross-modal consistency is the mean square error of the output of the two branches of the student model.

[0061] Step 104: The computing device generates enhanced image features containing novel attack features based on the threat intelligence and the multi-scale gram field image features.

[0062] The computing device can construct a predefined subset of ATT&CK techniques, containing common attack techniques; then, it uses one-hot encoding to construct an attack pattern vector, with each technique corresponding to one dimension of the attack pattern vector. If a technique is identified from the threat intelligence, the corresponding dimension is set to 1; otherwise, it is set to 0. In this way, the attack pattern vector indicating a new type of attack in the threat intelligence can be obtained.

[0063] The computing device first parses the threat intelligence, extracting observable entities from the CyberObservable Expression (CybOX) object. Then, it creates graph nodes based on these observable entities and assigns type and role labels to them. The role label indicates the node's role in the attack. For example, network entities include IP address, domain name, and port; file entities include file path, hash value, and file size; and process entities include process ID, process name, and command-line arguments.

[0064] Then, the computing device infers the relationships between entities as edges based on the relevant temporal relationships of entities, such as creation time, action execution time, and logical relationships, thereby obtaining an attack chain analysis graph; these logical relationships are inferred from a predefined rule base. For example, these logical relationships include process creating a file, process connecting to a port, process modifying the registry, and action A depending on action B.

[0065] The computing device can predefine a list of various attack behaviors, which includes a mapping relationship between attack behaviors and entities. For each attack behavior in the list, its strength score is calculated based on the attack chain analysis graph. In this way, the computing device can construct attack behavior characteristics based on the strength scores of these various attack behaviors.

[0066] Specifically, the computing device detects and analyzes whether there are key nodes in the graph that can be directly mapped to a certain attack behavior. If so, the base score is accumulated. If the betweenness centrality of the key node is greater than the mean betweenness centrality of the nodes in the graph, the keyness score is further accumulated to obtain the intensity score.

[0067] Preferably, the computing device can generate the new attack feature based on the attack patterns and attack behavior characteristics in the threat intelligence; project the new attack feature onto the same dimension as the multi-scale Gram field image feature to obtain the attack projection feature; and add or multiply the multi-scale Gram field image feature and the attack projection feature to generate the enhanced image feature.

[0068] The computing device can weight and concatenate the vector and attack behavior features of the attack pattern to obtain a new attack feature; then, based on the relevant data of the new attack feature in the threat intelligence, a GAF image is generated to obtain the typical representation of the new attack feature in the GAF image; then, the typical representation is mapped to the feature space of the teacher model so that the detection output of the teacher model of the new attack feature can guide the student model.

[0069] Step 105: The computing device performs first adversarial training on the student model based on the enhanced image features through the first generative adversarial network.

[0070] The generator of the first generative adversarial network is used to generate a first training sample based on the enhanced image features; the discriminator of the first generative adversarial network is used to determine whether the first training sample input to the teacher model and the student model is a real sample or a generated sample based on the first output data of the teacher model and the student model.

[0071] Specifically, the first training sample includes the enhanced image feature itself, i.e., the real sample, and the generated sample based on the enhanced image feature.

[0072] Specifically, the generator of the first generative adversarial network needs to verify the quality of the generated samples and maintain the semantic consistency of the attack behavior; specifically, the confidence level of the teacher model's detection output of the generated samples as the corresponding attack behavior needs to be greater than a set threshold.

[0073] Preferably, the loss function of the generator of the first generative adversarial network includes an adversarial loss term and an attack loss term. The adversarial loss term is inversely proportional to the probability of the discriminator of the first generative adversarial network correctly judging the generated sample, and the attack loss term is inversely proportional to the difference in output between the student model and the teacher model for the first training sample.

[0074] Preferably, the student model further includes a classification layer; the computing device selects the core parameters of the student model using the Elastic Weight Consolidation (EWC) algorithm; during the first adversarial training, the core parameters of the semantic input branch and the image input branch remain unchanged, the core parameters of the gated fusion layer are updated with a first learning rate, and the core parameters of the classification layer are updated with a second learning rate, wherein the first learning rate is less than the second learning rate; during the first adversarial training, the loss function of the student model includes a knowledge distillation loss term and an elastic weight consolidation regularization loss term, wherein the knowledge distillation loss term is used to penalize the output difference between the student model and the teacher model based on the first training sample, and the output difference is proportional to the knowledge distillation loss term, and the elastic weight consolidation regularization loss term is proportional to the adjustment magnitude of the core parameters.

[0075] By fine-tuning the core parameters of the gating fusion layer and classification layer of the student model after acquiring new threat intelligence, rapid model updates can be achieved.

[0076] In the first adversarial training, the computing device uses a mixed dataset of the first and second training samples as training data to prevent catastrophic forgetting in the student model.

[0077] Step 106: The computing device detects network attack behavior using the student model trained by the first adversarial training.

[0078] In this process, through the second adversarial training, the student model inherits knowledge from the teacher model through knowledge distillation and integrates multimodal data containing GAF images and semantic features, achieving an accuracy similar to that of the teacher model in the detection of known attacks. Then, through the first adversarial training and threat intelligence guidance, the student model can quickly adapt to unknown attack variants and improve the detection rate of zero-day attacks.

[0079] At this point, using this student model for real-time attack detection in actual network security defense solves the problem of the lag in plug-in security solutions and achieves the integration of business and security.

[0080] In this embodiment, by converting alarm frequencies into multi-scale Gram field image features, attack characteristics at different time scales can be captured, allowing for intuitive identification of complex attack chains and hidden correlations across time dimensions. This reduces the false negative rate and improves the detection capability against unknown variant attacks and low-frequency, slow attacks. When acquiring new threat intelligence, targeted first training samples are generated by combining multi-scale Gram field images, and the first adversarial training of the student model is quickly triggered, achieving a precise improvement in the detection capability against new attacks and addressing the problem of defense lag.

[0081] Please see Figure 2, Figure 2 A schematic diagram of a threat intelligence-guided adversarial knowledge distillation detection system provided in this application embodiment is shown below. Figure 2 As shown, the system 20 includes: Module 201 is used to acquire alarm data and threat intelligence; The first generation module 202 is used to generate multi-scale Gram angle field image features based on the time-series data of alarm frequency in the alarm data. The first training module 203 is used to train the teacher model and the student model based on the multi-scale Gram angle field image features; wherein, the input of the teacher model and the student model both include the multi-scale Gram angle field image features, and the output of the teacher model and the student model are both probability distributions of attack behavior types; The second generation module 204 is used to generate enhanced image features containing novel attack features based on the threat intelligence and the multi-scale Gram angle field image features; wherein, the novel attack features are obtained based on the threat intelligence; The second training module 205 is used to perform first adversarial training on the student model based on the enhanced image features through the first generative adversarial network; wherein, the generator of the first generative adversarial network is used to generate first training samples based on the enhanced image features; the discriminator of the first generative adversarial network is used to determine whether the first training samples input to the teacher model and the student model are real samples or generated samples based on the first output data of the teacher model and the student model. The detection module 206 is used to detect network attack behavior through the student model trained by the first adversarial approach.

[0082] The threat intelligence-guided adversarial knowledge distillation detection system provided in this application can be understood by referring to the relevant content in the foregoing method embodiment section, and will not be repeated here.

[0083] like Figure 3 As shown, Figure 3 This is a schematic diagram of a possible logical structure of a computing device provided in an embodiment of this application. The computing device 30 includes a processor 301, a communication interface 302, a memory 303, and a bus 304. The processor 301, the communication interface 302, and the memory 303 are interconnected via the bus 304. In an embodiment of this application, the processor 301 is used to control and manage the operation of the computing device 30. For example, the processor 301 is used to execute... Figure 1 The steps in the embodiments and / or other processes used in the techniques described herein. Communication interface 302 is used to support communication by computing device 30. Memory 303 is used to store program code and data of computing device 30.

[0084] The processor 301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, etc. The bus 304 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0085] In another embodiment of this application, a computer-readable storage medium is also provided, the computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the above-described... Figure 1 The method described in the embodiments.

[0086] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0087] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0088] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0089] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0090] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0091] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A threat intelligence-guided adversarial knowledge distillation detection method, characterized in that, The method includes: Obtain alert data and threat intelligence; Based on the time-series data of alarm frequency in the alarm data, multi-scale Gram angle field image features are generated; The teacher model and the student model are trained based on the multi-scale Gram angle field image features; wherein the input of the teacher model and the student model both include the multi-scale Gram angle field image features, and the output of the teacher model and the student model are both probability distributions of attack behavior types; Based on the threat intelligence and the multi-scale Gram angle field image features, enhanced image features containing novel attack features are generated; wherein, the novel attack features are obtained based on the threat intelligence; The student model is subjected to first adversarial training based on the enhanced image features through a first generative adversarial network; wherein, the generator of the first generative adversarial network is used to generate first training samples based on the enhanced image features; and the discriminator of the first generative adversarial network is used to determine whether the first training samples input to the teacher model and the student model are real samples or generated samples based on the first output data of the teacher model and the student model. The student model, trained using the first adversarial approach, is used to detect network attack behavior.

2. The method according to claim 1, characterized in that, The training of the teacher and student models based on the multi-scale Gram angle field image features includes: The teacher model and the student model are trained adversarially using a second generative adversarial network based on the multi-scale Gram field image features. The generator of the second generative adversarial network is used to generate the second training samples based on the multi-scale Gram field image features, and the discriminator of the second generative adversarial network is used to determine whether the second training samples input to the teacher model and the student model are real samples or generated samples based on the second output data of the teacher model and the student model.

3. The method according to claim 1 or 2, characterized in that, The generation of multi-scale Gram angle field image features based on time-series data of alarm frequency in the alarm data includes: The alarm frequencies are statistically analyzed according to different time granularities to generate alarm frequency sequences at multiple time scales; The alarm frequency sequence at each time scale is normalized to polar coordinates, and the element values ​​in the alarm frequency sequence are mapped to polar angles. Calculate the Gram angle field matrix based on the polar angle, and generate the corresponding image features; The image features from multiple time scales are stitched together along the channel dimension to obtain the multi-scale Gram angle field image features.

4. The method according to claim 1 or 2, characterized in that, The generation of enhanced image features containing novel attack features based on the threat intelligence and the multi-scale Gram field image features includes: Based on the attack patterns and attack behavior characteristics in the threat intelligence, the new attack characteristics are generated; The novel attack features are projected onto the same dimension as the multi-scale Gram angle field image features to obtain the attack projection features; The enhanced image features are generated by adding or multiplying the multi-scale Gram angle field image features and the attack projection features.

5. The method according to claim 1 or 2, characterized in that, The input of the student model also includes semantic embedding features, which are generated based on the alarm fields in the alarm data. The student model includes a semantic input branch, an image input branch, and a gated fusion layer. The gated fusion layer is used to fuse the output of the semantic input branch and the output of the image input branch to obtain fused features.

6. The method according to claim 5, characterized in that, The student model further includes a classification layer; the first adversarial training of the student model based on the enhanced image features includes: The core parameters of the student model are selected by integrating the EWC algorithm with elastic weights. During the first adversarial training process, the core parameters of the semantic input branch and the image input branch remain unchanged, the core parameters of the gated fusion layer are updated with a first learning rate, and the core parameters of the classification layer are updated with a second learning rate, wherein the first learning rate is less than the second learning rate. During the first adversarial training process, the loss function of the student model includes a knowledge distillation loss term and an elastic weight consolidation regularization loss term. The knowledge distillation loss term is used to penalize the output difference between the student model and the teacher model based on the first training sample. The output difference is proportional to the knowledge distillation loss term. The elastic weight consolidation regularization loss term is proportional to the adjustment magnitude of the core parameters.

7. The method according to claim 6, characterized in that, The loss function of the generator in the first generative adversarial network includes an adversarial loss term and an attack loss term. The adversarial loss term is inversely proportional to the probability that the discriminator of the first generative adversarial network determines the generated sample as a real sample, and the attack loss term is inversely proportional to the output difference.

8. A threat intelligence-guided adversarial knowledge distillation detection system, characterized in that, The system, applied to the method of any one of claims 1-7, comprises: The acquisition module is used to acquire alarm data and threat intelligence; The first generation module is used to generate multi-scale Gram angle field image features based on the time-series data of alarm frequency in the alarm data. The first training module is used to train the teacher model and the student model based on the multi-scale Gram angle field image features; wherein the input of the teacher model and the student model both include the multi-scale Gram angle field image features, and the output of the teacher model and the student model are both probability distributions of attack behavior types; The second generation module is used to generate enhanced image features containing novel attack features based on the threat intelligence and the multi-scale Gram field image features; wherein the novel attack features are obtained based on the threat intelligence; The second training module is used to perform first adversarial training on the student model based on the enhanced image features through the first generative adversarial network; wherein, the generator of the first generative adversarial network is used to generate first training samples based on the enhanced image features; the discriminator of the first generative adversarial network is used to determine whether the first training samples input to the teacher model and the student model are real samples or generated samples based on the first output data of the teacher model and the student model. The detection module is used to detect network attack behaviors using the student model trained by the first adversarial approach.

9. A computing device, characterized in that, include: Memory, used to store programs; A processor for loading the program to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method of any one of claims 1-7.

Images