Cybersecurity alert scoring method, apparatus, device, and storage medium

Abstract

The application relates to the technical field of safety warning, and discloses a network security warning scoring method and device, equipment and a storage medium, which comprises the following steps: obtaining network security warning data to be scored; inputting the network security warning data into a pre-trained target student model to obtain a risk score corresponding to the network security warning data, wherein the target student model is trained through high-level discriminative semantic representation of a teacher model and alignment feature representation of a preset student model, and the alignment feature representation is obtained by projecting and mapping a plurality of intermediate feature representations of the preset student model to a semantic space where the high-level discriminative semantic representation of the teacher model is located. In the training process, the high-level discriminative semantic representation of the teacher model is used as a supervision target, and the plurality of intermediate feature representations of the teacher model are mapped to the high-level semantic space for alignment, so that high-precision scoring of complex network security warning data is realized under the premise of ensuring the calculation efficiency.

Description

Technical Field

[0001] This application relates to the field of security alarm technology, and in particular to a network security alarm scoring method, apparatus, device and storage medium. Background Technology

[0002] In the scenario of network security alarm scoring, due to the significant architectural differences between the teacher model and the student model in terms of network depth, channel dimension and structural form, traditional distillation methods are usually constrained only by Euclidean distance or simple feature matching. They lack effective feature decoupling mechanisms and cross-architecture adaptive mapping capabilities, which leads to the introduction of a large amount of redundant information and background noise when the student model learns the high-dimensional features of the teacher model, making it difficult to inherit the teacher model's ability to distinguish complex attack behaviors. Summary of the Invention

[0003] The main purpose of this application is to provide a network security alarm scoring method, device, equipment and storage medium, which aims to solve the technical problem that traditional distillation methods lack effective feature decoupling mechanisms and cross-architecture adaptive mapping capabilities in network security alarm scoring scenarios, making it difficult for student models to inherit the teacher model's ability to distinguish complex attack behaviors.

[0004] To achieve the above objectives, this application proposes a network security alarm scoring method, the method comprising: Obtain network security alert data to be scored; The network security alarm data is input into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data. The target student model is trained by the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the preset student model. The alignment feature representation is obtained by mapping the multi-layer intermediate feature representation of the preset student model to the semantic space where the high-level discriminative semantic representation of the teacher model is located through the projection mapping module.

[0005] Optionally, before inputting the network security alarm data into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data, the method further includes: Obtain a teacher model and a preset student model, and determine the high-level discriminative semantic representation of the teacher model and the multi-level intermediate feature representation of the preset student model; The multi-layer intermediate feature representation is mapped to the semantic space corresponding to the high-level discriminative semantic representation to obtain the aligned feature representation; Based on the high-level discriminative semantic representation and the alignment feature representation, construct the constraint conditions; The parameters of the preset student model are optimized based on the constraints and training data to obtain the target student model.

[0006] Optionally, the constraints include cross-correlation constraints and topological constraints; The step of constructing constraints based on the high-level discriminative semantic representation and the alignment feature representation includes: The high-level discriminative semantic representation and the alignment feature representation are standardized to obtain the target high-level discriminative semantic representation and the target alignment feature representation. Based on the target high-level discriminative semantic representation and the target alignment feature representation, a cross-correlation matrix and a Gram matrix are constructed. Construct cross-correlation constraints based on the cross-correlation matrix; Construct topological constraints based on the stated Gram matrix.

[0007] Optionally, constructing cross-correlation constraints based on the cross-correlation matrix includes: The first constraint is determined based on the diagonal elements of the cross-correlation matrix; The second constraint is determined based on the off-diagonal elements of the cross-correlation matrix; Construct cross-correlation constraints based on the first constraint and the second constraint.

[0008] Optionally, constructing topological constraints based on the Gram matrix includes: Determine the first gram matrix corresponding to the high-level discriminative semantic representation and the second gram matrix corresponding to the aligned feature representation; Based on the first and second gram matrices, the topological constraints are determined.

[0009] Optionally, before obtaining the teacher model and the preset student model, and determining the high-level discriminative semantic representation of the teacher model and the multi-layer intermediate feature representation of the preset student model, the method further includes: Obtain the raw alarm log data generated by each node in the network test range; Multidimensional feature extraction is performed on the original alarm log data to obtain alarm feature data; The alarm feature data is associated with the corresponding labeled scores to obtain training data.

[0010] Optionally, after associating the alarm feature data with the corresponding labeled scores to obtain training data, the method further includes: Map the alarm feature data in the training data into a multi-dimensional feature vector; With the goal of minimizing the difference between the predicted score and the labeled score in the training data, the teacher model is subjected to supervised fine-tuning training based on the multidimensional feature vector and the labeled score to obtain the teacher model.

[0011] Furthermore, to achieve the above objectives, this application also proposes a network security alarm scoring device, which includes: The acquisition module is used to acquire network security alert data to be scored; The input module is used to input the network security alarm data into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data. The target student model is trained by the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the preset student model. The alignment feature representation is obtained by mapping the multi-layer intermediate feature representation of the preset student model to the semantic space where the high-level discriminative semantic representation of the teacher model is located through the projection mapping module.

[0012] In addition, to achieve the above objectives, this application also proposes a network security alarm scoring device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network security alarm scoring method described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the network security alarm scoring method described above.

[0014] This application uses the high-level discriminative semantic representation of the teacher model as the supervision target during training, mapping its own multi-layer intermediate feature representations to this high-level semantic space for alignment. This allows the student model to inherit the discriminative ability of the teacher model under a unified semantic reference, and directly perform inference on the network security alarm data to be scored through a pre-trained target student model. This improves the stability of distillation between heterogeneous models and the effect of knowledge transfer, thereby achieving high-precision scoring of complex network security alarm data while ensuring computational efficiency. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1This is a flowchart illustrating the first embodiment of the network security alarm scoring method of this application; Figure 2 This is a schematic diagram illustrating the overall framework of the network security alarm scoring method in this application; Figure 3 This is a flowchart illustrating the second embodiment of the network security alarm scoring method of this application; Figure 4 This is a schematic diagram of the cross-correlation distillation and topology preservation mechanism of this application; Figure 5 This is a schematic diagram of the module structure of the network security alarm scoring device according to an embodiment of this application; Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the network security alarm scoring method in this application embodiment.

[0018] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] With the rapid development of artificial intelligence technology, large-scale distributed network ranges have demonstrated significant application value in the field of cybersecurity. These platforms typically build highly realistic simulation environments based on cloud computing technology, supporting the entire process from single-point vulnerability discovery to large-scale red team / blue team exercises. During realistic attack and defense exercises, network ranges generate massive amounts of multi-source, heterogeneous security alerts in a short period. Simultaneously, attack methods exhibit high complexity and stealth, involving APTs (Advanced Persistent Threats), zero-day exploits, and multi-stage composite attack chains. Therefore, to achieve automated adjudication and real-time situational awareness in the range environment, efficient and accurate risk scoring and classification of massive security alerts is urgently needed. In existing technologies, rule-based matching or shallow machine learning methods are mainly used for security alert scoring. These methods typically have low computational overhead and are easy to deploy, but they lack the ability to model contextual semantics when facing complex attack chains and unstructured alert descriptions, resulting in high false positive and false negative rates, making it difficult to meet the needs of realistic network ranges for refined risk assessment.

[0022] In recent years, intelligent scoring methods based on large language models have gradually attracted attention. These methods rely on large-scale pre-trained models, possessing strong semantic understanding and reasoning capabilities, and can score security alerts with high accuracy based on complex expert rules. However, these methods typically suffer from high inference latency, large memory consumption, and high computational costs, making large-scale deployment difficult in resource-constrained network target range edge nodes. To balance model performance and computational efficiency, existing technologies often employ knowledge distillation methods to transfer knowledge from high-performance teacher models to lightweight student models. However, in the scenario of network security alert scoring, due to significant architectural differences between teacher and student models and a high model compression ratio, traditional distillation methods still have the following shortcomings: First, existing distillation methods are mostly based on Euclidean distance or simple feature matching for constraints, lacking effective feature decoupling mechanisms. This leads to the student model introducing a large amount of redundant information and background noise while learning high-dimensional features from the teacher model, making it difficult to extract key discriminative features such as attack intent, thus reducing the model's discriminative ability. Second, existing methods typically only perform feature alignment for individual samples, ignoring the overall structural relationships between different alert samples in the feature space. In cybersecurity scenarios, different attack types often possess specific correlation structures and geometric relationships in the feature space. Traditional methods fail to maintain the consistency of this topological structure, making it difficult for student models to inherit the overall cognitive ability of teacher models regarding complex attack chains, thus limiting generalization performance. Furthermore, due to significant differences between teacher and student models in terms of network depth, channel dimensions, and structural forms, existing methods lack adaptive feature mapping mechanisms for heterogeneous architectures. This makes it difficult to effectively map the multi-layered features of student models to the high-level semantic space of teacher models, further impacting knowledge transfer effectiveness.

[0023] In summary, existing technologies struggle to achieve both high accuracy and high efficiency in security alarm scoring within resource-constrained network range environments, particularly in areas such as feature redundancy, missing structural information, and heterogeneous model alignment.

[0024] Therefore, to overcome the limitations of existing technologies in balancing real-time performance and accuracy of security alarm scoring in resource-constrained network test environments, and the shortcomings of traditional lightweight distillation methods that easily lead to severe feature coupling and decreased discriminative ability under heterogeneous architectures and high compression ratios, this application proposes a network security alarm scoring technique based on cross-correlation knowledge distillation and panoramic semantic anchoring. By constructing a high-quality semantic teacher model and performing structured knowledge transfer on the student model in a unified semantic space, a lightweight model can achieve high-precision scoring capability for complex security alarms in low-computing-power environments.

[0025] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, model training, and program execution functions, such as a computer, or an electronic device capable of performing the above functions. The following uses a network security alarm scoring system as an example to illustrate this embodiment and the subsequent embodiments.

[0026] Based on this, embodiments of this application provide a network security alarm scoring method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network security alarm scoring method of this application.

[0027] In this embodiment, the network security alarm scoring method includes: Step S10: Obtain the network security alarm data to be scored.

[0028] It should be noted that network security alert data refers to raw alert records generated by network ranges or network security monitoring systems. These records indicate potential security threats or abnormal behavior and include, but are not limited to, alert occurrence time, source IP address, destination IP address, alert type, attack stage identifier, initial threat level assessment, and original alert description text. This network security alert data typically originates from multiple monitoring nodes, including but not limited to intrusion detection systems, firewall logs, endpoint security agents, and traffic analysis probes. Optionally, network security alert data may also include network traffic characteristics, system log fragments, process behavior information, and threat intelligence-related data. Specifically, as an optional implementation, data acquisition agents deployed at each edge node of the network range monitor alarm events generated by security devices in real time. When a new alarm event is detected, the data acquisition agent actively pulls the raw data of the alarm event and encapsulates it in a standardized manner according to a preset data format to obtain network security alarm data in a standard format.

[0029] In another optional implementation, the network security alarm data is uniformly received by the situational awareness platform of the network range from the alarm information reported by each security device, and then pushed to the scoring system via a message queue. The scoring system obtains the alarm data to be scored from the message queue through a subscription method.

[0030] Step S20: Input the network security alarm data into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data. The target student model is trained by the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the preset student model. The alignment feature representation is obtained by mapping the multi-layer intermediate feature representation of the preset student model to the semantic space where the high-level discriminative semantic representation of the teacher model is located through the projection mapping module.

[0031] It should be noted that, in this embodiment, the target student model refers to a lightweight neural network model obtained after knowledge distillation training. This model is used to perform real-time inference on input cybersecurity alert data and output standardized risk scores in resource-constrained computing environments. The teacher model is a high-performance pre-trained language model with a large number of parameters and strong semantic understanding capabilities. After supervised fine-tuning in the cybersecurity domain, the teacher model can form discriminative semantic representations in a high-level feature space. The preset student model is an untrained lightweight neural network model, and its network depth, channel dimension, and structural form differ from the teacher model.

[0032] It should be understood that the high-level discriminative semantic representation is the feature vector output by the feature mapping layer before the teacher model's output layer. This high-level discriminative semantic representation not only includes alarm scoring information but also implicitly contains the structural relationships between different alarm categories. The aligned feature representation is the feature vector obtained by transforming and semantically mapping the intermediate layer features of the student model through the projection mapping module. The aligned feature representation resides in the same semantic space as the high-level discriminative semantic representation of the teacher model.

[0033] Understandably, multi-layer intermediate feature representations are intermediate features with different semantic levels output by the student model at different network layers. The semantic space refers to the vector space corresponding to the high-level features of the teacher model, used to represent the semantic information of the alarm. The projection mapping module is set in the network module after the student model's feature layer, mapping the multi-layer intermediate feature representations into the semantic space to achieve adaptive alignment between the student model features and the teacher model's semantic space under heterogeneous architecture.

[0034] In one example, reference Figure 2 , Figure 2 This is a schematic diagram of the overall framework of the network security alarm scoring method of this application. The first stage starts with the input of network security alarm data. This stage corresponds to the training or fine-tuning process of the teacher model. The network security alarm data goes through layer-by-layer semantic encoding and feature transformation in stages 1, 2, 3 up to stage N. Finally, after stage N, a high-level discriminative semantic representation is extracted as the feature output of this stage, and the corresponding scoring output is generated based on this.

[0035] The second stage corresponds to the distillation training process of the student model. This stage also starts with network security alarm data as input. The data flows through the lightweight network layers from stage 1 to stage N in sequence to extract the intermediate layer features of the student model. These features are then semantically aligned through the projection mapping module to generate aligned feature representations as the feature output of this stage. Distillation constraints are then constructed based on the feature output. Used to train student models, where , These are the weighting coefficients. The loss for the student model's own prediction task. For cross-correlated distillation losses, This represents the loss due to topological consistency.

[0036] The third stage corresponds to the inference deployment stage after training is completed. This stage takes the actual network security alarm data to be scored as input. The data goes through the student model forward inference from stage 1 to stage N in sequence to extract the intermediate layer features of the inference stage, and directly outputs the corresponding risk score as the final result based on the features. This stage does not involve the participation of the teacher model and does not require feature mapping operations.

[0037] It should be understood that the above framework mainly includes the following two parts: First, a teacher model framework based on multidimensional expert knowledge is constructed. This framework introduces multidimensional security assessment rules and combines them with supervised fine-tuning techniques to perform domain-adaptive training on a large-scale pre-trained model, enabling it to output standardized risk scoring results based on alarm context information. This teacher model not only possesses strong semantic understanding and reasoning capabilities, but also forms discriminative semantic representations related to the cybersecurity domain in its high-dimensional feature space, providing effective supervision signals and semantic references for subsequent knowledge distillation.

[0038] Secondly, a cross-correlation distillation architecture based on adaptive projection is constructed. Addressing the differences in structural form and feature representation between the student and teacher models, a projection mapping module is introduced after the student model's feature layer. This module maps the multi-layer features of the student model to the high-level semantic space of the teacher model, achieving unified alignment between heterogeneous features. Building upon this, a distillation mechanism is designed that includes cross-correlation alignment constraints and topological consistency constraints. On the one hand, by constraining the cross-correlation relationships across model features, redundant feature interference is reduced, improving the independence of feature representation. On the other hand, by maintaining the consistency of structural relationships within the feature space, the student model can inherit the discriminative structure of the teacher model across different alarm categories, thereby enhancing the model's ability to identify complex attack patterns.

[0039] Understandably, the ultimate goal of the above architecture is to learn a supervised alert scoring model (i.e., a trained target learning model) for a distributed network range system. This model maps the input domain (such as network security alert data, log features, and contextual information) to the output domain (such as standardized risk scoring results). Typically, this model is a parameterized model, using parameters... Parameterizing it, we can represent it as follows:

[0040] in, This represents the input alarm characteristic data. This represents the corresponding risk score result. In network range systems, alarm data typically originates from multiple nodes and is heterogeneous and highly concurrent. Therefore, the model needs to possess strong semantic understanding and discrimination capabilities while ensuring computational efficiency.

[0041] In this embodiment, the high-level discriminative semantic representation of the teacher model is used as the supervision target during training. The student model maps its own multi-layered intermediate feature representations to this high-level semantic space for alignment, enabling the student model to inherit the discriminative ability of the teacher model under a unified semantic reference. Furthermore, the student model directly performs inference on the network security alarm data to be scored using a pre-trained target student model. This improves the stability of distillation between heterogeneous models and the effect of knowledge transfer, thereby achieving high-precision scoring of complex network security alarm data while ensuring computational efficiency.

[0042] Reference Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the network security alarm scoring method of this application. Based on the first embodiment described above, a second embodiment of the network security alarm scoring method of this application is proposed.

[0043] In the second embodiment, before step S20, the method further includes: Step S201: Obtain the teacher model and the preset student model, and determine the high-level discriminative semantic representation of the teacher model and the multi-level intermediate feature representation of the preset student model.

[0044] It should be noted that the preset student model is an initialized lightweight neural network model, which requires parameter optimization through knowledge distillation. The network depth, channel dimension, and structural form of the preset student model differ from those of the teacher model.

[0045] It is understandable that when determining the high-level discriminative semantic representation of the teacher model and the multi-layer intermediate feature representation of the preset student model, the same training data can be input into the teacher model and the preset student model respectively for forward propagation, and the corresponding feature outputs can be obtained from the specified feature extraction layer of the teacher model and multiple network layers of the preset student model respectively. The order of obtaining the teacher model and the preset student model is not important, and this embodiment does not limit this.

[0046] Specifically, alarm feature vectors from the training data are input into the teacher model for forward propagation. A feature extraction interface is set before the output layer of the teacher model. When the data propagates to the network layer corresponding to the feature extraction interface, the high-dimensional feature vector output from that network layer is obtained as the high-level discriminative semantic representation corresponding to that training data. The training data includes alarm feature vectors obtained after multi-dimensional feature extraction from the original alarm log data generated by each node in the network test range, as well as the labeled scores corresponding to each alarm feature vector. When determining the multi-layer intermediate feature representation of the preset student model, the same training data is input into the preset student model for forward propagation. Feature extraction interfaces are set in multiple different network layers of the preset student model. When the data propagates to the network layer corresponding to each feature extraction interface, the intermediate feature vector output from each network layer is obtained to obtain the multi-layer intermediate feature representation.

[0047] In the specific implementation process, to provide a high-quality standardized data foundation for the knowledge learning of the teacher model and the distillation training of the student model, and to ensure that the model can comprehensively understand the alarm context information from multiple dimensions, thereby improving the accuracy and reliability of the scoring, the following steps are included before step S201: Obtain the raw alarm log data generated by each node in the network test range; Multidimensional feature extraction is performed on the original alarm log data to obtain alarm feature data; The alarm feature data is associated with the corresponding labeled scores to obtain training data.

[0048] It should be noted that the nodes in the network range refer to various business nodes deployed in the distributed network range system, including but not limited to virtual host nodes, physical server nodes, network device nodes, security device nodes, and traffic collection nodes. The raw alarm log data consists of unprocessed alarm event records generated by the security monitoring components deployed on each node during operation. Its data format and field definitions vary depending on the source device, exhibiting multi-source heterogeneous characteristics.

[0049] Understandably, multidimensional feature extraction can extract structured feature information from raw alarm log data across multiple dimensions to characterize the state of alarm events at different attribute levels. Alarm feature data is a structured feature vector or feature set formed after multidimensional feature extraction. The labeled score is a risk score value pre-labeled on the alarm feature data by security experts or based on an expert rule base, used as a supervisory signal for model training.

[0050] Specifically, in this embodiment, a teacher model is introduced. With student model This is a collaborative learning framework where a teacher model provides high-quality semantic supervision signals, and a student model enables efficient reasoning in resource-constrained environments. Next, training data is obtained; let the training dataset be:

[0051] in Indicates the first Alarm characteristic data, This represents the corresponding true rating label, where N is the number of alarm feature data. Training data is usually from an unknown distribution. Sampling.

[0052] In the specific implementation process, in order to enable the general pre-trained language model to adapt to the professional domain task of network security alarm scoring, it learns the complex nonlinear relationships between multi-dimensional expert knowledge and forms a semantic representation with discriminative capabilities in the high-level feature space. At this point, after associating the alarm feature data with the corresponding labeled scores to obtain training data, the process further includes: Map the alarm feature data in the training data into a multi-dimensional feature vector; With the goal of minimizing the difference between the predicted score and the labeled score in the training data, the teacher model is subjected to supervised fine-tuning training based on the multidimensional feature vector and the labeled score to obtain the teacher model.

[0053] It should be noted that the predicted score refers to the risk score predicted by the pre-trained teacher model after forward propagation calculation based on the input multi-dimensional feature vector. The pre-trained teacher model refers to a pre-trained large language model or deep neural network model with strong semantic understanding and feature extraction capabilities, but it has not been specifically optimized for the cybersecurity alarm scoring task.

[0054] Understandably, by using labeled training data and labeled scores as a supervisory signal, supervised fine-tuning of the network parameters of the pre-set teacher model can make the model adapt to the specific downstream task of network security alarm scoring.

[0055] Specifically, in a distributed network range system, to achieve high-precision alarm scoring, a teacher model needs to be constructed first. In existing methods, general pre-trained models are difficult to directly adapt to the complex scoring logic in network security scenarios. Therefore, this embodiment introduces multi-dimensional expert knowledge to adapt the teacher model to the domain. Specifically, the alarm scoring problem is modeled as a multi-factor joint decision-making problem, and alarm features are represented as multi-dimensional feature vectors:

[0056] in Indicates the first Features and information in multiple dimensions, including but not limited to attack threat level, asset importance, attack phase information, time context, and threat intelligence.

[0057] The teacher model is trained using supervised fine-tuning, and its objective function is expressed as:

[0058] in This represents the regression or classification loss function. To pre-define the teacher model ontology, Let be the true risk score label corresponding to the i-th sample, and N be the total number of samples in the training dataset.

[0059] Through the above process, the teacher model can learn the complex nonlinear relationships between multidimensional features and form a high-level discriminative semantic representation with discriminative capabilities in its high-level feature space:

[0060] in This represents the feature mapping function of the teacher model before the output layer. The high-level discriminative semantic representation not only contains scoring result information but also implicitly contains the structural relationships between different alarm categories, providing semantic reference for subsequent knowledge distillation.

[0061] Step S202: Map the multi-layer intermediate feature representation to the semantic space corresponding to the high-level discriminative semantic representation to obtain the aligned feature representation.

[0062] Understandably, due to significant differences in network depth, channel dimension, and structural form between the teacher model and the pre-defined student model, the multi-layer intermediate feature representation of the student model and the high-level discriminative semantic representation of the teacher model are not directly comparable in terms of feature dimension and semantic level. Therefore, a projection mapping module is needed to map the multi-layer intermediate feature representation of the student model to the semantic space of the high-level discriminative semantic representation of the teacher model. This ensures that the mapped aligned feature representation and the high-level discriminative semantic representation of the teacher model are in a unified semantic space, thus providing comparable paired features for subsequent constraint construction. The mapping between the multi-layer intermediate feature representation and the high-level discriminative semantic representation is performed for each input data in each training iteration. That is, after the multi-layer intermediate feature representation is obtained through forward propagation of the pre-defined student model, each layer of intermediate features is immediately input into the corresponding projection mapping module for mapping transformation to obtain the aligned feature representation.

[0063] Specifically, regarding input alarm data The student model outputs intermediate feature representations at different layers:

[0064] in This indicates the number of layers in the student model, with features at different layers having different semantic levels. Let k be the feature extraction function of the student model. This represents the multi-layered intermediate feature set of the student model. Due to structural differences between the teacher and student models, this embodiment introduces an architecture-adaptive projection module to map student model features to the teacher semantic space. For the... Layer features, whose mapping representation is:

[0065] in This represents the projection function, used to achieve feature dimension alignment and semantic mapping. This represents the aligned feature representation of the k-th layer features of the student model after projection.

[0066] It should be understood that by introducing an architecture-adaptive projection module, feature space alignment between the student model and the teacher model under different structural conditions can be achieved, solving the problem of direct feature matching between heterogeneous models and improving knowledge transfer performance under high compression ratio conditions. Optionally, the projection mapping module can be implemented using different forms of nonlinear transformation structures or attention mechanisms.

[0067] Step S203: Construct constraint conditions based on the high-level discriminative semantic representation and the alignment feature representation.

[0068] In the specific implementation process, cross-correlation matrices can be constructed to mine the correlation between cross-model feature dimensions, and Gram matrices can be constructed to characterize the structural relationships between samples within each model. Then, cross-correlation constraints and topological constraints are constructed respectively, achieving synergistic constraints on the student model training process from two dimensions: feature decoupling and structure preservation. This effectively suppresses the feature redundancy and structural information loss problems existing in traditional distillation methods. Here, the constraints include cross-correlation constraints and topological constraints. Step S203 may include: The high-level discriminative semantic representation and the alignment feature representation are standardized to obtain the target high-level discriminative semantic representation and the target alignment feature representation. Based on the target high-level discriminative semantic representation and the target alignment feature representation, a cross-correlation matrix and a Gram matrix are constructed. Construct cross-correlation constraints based on the cross-correlation matrix; Construct topological constraints based on the stated Gram matrix.

[0069] It should be noted that the constraints are objective functions or regularization terms used during the training process to constrain the optimization of student model parameters. They are used to guide the student model to focus on the accuracy of score prediction during the learning process and to approximate the semantic expression ability and structural cognitive ability of the teacher model at the feature level.

[0070] Understandably, the constraints include cross-correlation constraints and topological constraints. Cross-correlation constraints are based on the cross-model feature correlation between the high-level discriminative semantic representation of the teacher model and the aligned feature representation of the student model. These constraints reduce redundant information in the student model's features and enhance the expressive power of key semantic features. Topological constraints are based on the consistency of the structural relationships between samples formed by the high-level discriminative semantic representation of the teacher model and the aligned feature representation of the student model in their respective feature spaces. These constraints enable the student model to inherit the teacher model's cognitive ability regarding the correlation structure between different alarm categories.

[0071] Understandably, after obtaining the high-level discriminative semantic representation of the teacher model and the aligned feature representation of the student model for each sample in the same batch of training data, the cross-correlation matrix and Gram matrix can be calculated based on these two feature representations to construct constraints. Both constraints are constructed based on the feature representations corresponding to multiple training data points in the same batch, rather than being calculated independently for a single sample, to ensure that the constraints reflect the statistical correlation and structural relationships between samples in the batch.

[0072] In one example, reference Figure 4 , Figure 4 This diagram illustrates the cross-correlation distillation and topology preservation mechanism of this application. The core of the mechanism lies in constructing constraints by comparing the statistical correlation and structural similarity between teacher model features and student model features. The upper part of the diagram illustrates the construction principle of the cross-correlation alignment constraints, where the left side represents the aligned feature representation obtained by projecting the student model, and the right side represents the high-level discriminative semantic representation of the teacher model. The two are used to measure the pairwise correlation of feature dimensions by calculating the cross-model cross-correlation matrix. In this part, The objective of the optimization under the cross-correlation constraint is to approximate the identity matrix by constraining the cross-correlation matrix. This achieves feature decoupling and semantic alignment. The lower half of the figure illustrates the construction principle of topology-preserving constraints, while the left side constructs the Gram student feature matrix based on the aligned feature representation of the student model. On the right, the Gram teacher feature matrix is ​​constructed based on the high-level discriminative semantic representation of the teacher model. Both are sample similarity matrices, used to characterize the structural relationships between different alarm samples in their respective feature spaces. In this section, through... The optimization objective represents the loss of topological consistency, which is achieved by calculating the student Gram matrix. With teacher Gram matrix The difference between the two models is measured by the square of the Frobenius norm. By minimizing this difference, the student model can inherit the discriminative structural relationship between different alarm categories in the feature space from the teacher model.

[0073] Specifically, in order to eliminate scale differences between different models, the features are first standardized:

[0074] in, The standardized feature vector, The original feature vector (which could be the teacher's) or students ), The mean of the features, The standard deviation is the characteristic.

[0075] Based on this, this embodiment constructs a cross-correlation matrix:

[0076] in For batch size, the elements in the cross-correlation matrix This represents the correlation between feature dimensions. Furthermore, to preserve the structural relationships in the teacher model's feature space, a Gram matrix is ​​constructed:

[0077] Finally, the corresponding constraints are determined based on the constructed cross-correlation matrix and Gram matrix.

[0078] In the specific implementation process, constraints on diagonal elements can be used to ensure semantic consistency between the teacher model and the student model in corresponding feature dimensions, while constraints on off-diagonal elements can ensure independence between different feature dimensions, reduce redundancy, effectively alleviate the discriminative ability degradation problem caused by feature coupling during distillation, and enhance the student model's ability to express key semantic features. At this point, the construction of cross-correlation constraints based on the cross-correlation matrix can include: The first constraint is determined based on the diagonal elements of the cross-correlation matrix; The second constraint is determined based on the off-diagonal elements of the cross-correlation matrix; Construct cross-correlation constraints based on the first constraint and the second constraint.

[0079] It should be noted that the cross-correlation matrix is ​​a cross-model feature correlation matrix constructed based on the target high-level discriminative semantic representation and target alignment feature representation corresponding to multiple training data in the same batch. The rows of the matrix correspond to each feature dimension of the high-level discriminative semantic representation of the teacher model, and the columns correspond to each feature dimension of the alignment feature representation of the student model. Each element in the matrix represents the correlation measure between a certain feature dimension of the teacher model and a certain feature dimension of the student model.

[0080] Understandably, each diagonal element of the cross-correlation matrix corresponds to the correlation between a certain dimension of the high-level discriminative semantic representation of the teacher model and the same dimension of the aligned feature representation of the student model. Each off-diagonal element corresponds to the correlation between a certain feature dimension of the teacher model and another different feature dimension of the student model.

[0081] It should be understood that the first constraint is constructed based on the diagonal elements of the cross-correlation matrix and is used to constrain the semantic consistency between the teacher model and the student model in corresponding feature dimensions. The second constraint is constructed based on the off-diagonal elements of the cross-correlation matrix and is used to constrain the independence between different feature dimensions and reduce feature redundancy.

[0082] In one example, to achieve feature decoupling and semantic alignment, the cross-correlation distillation loss is defined as: :

[0083] in, diagonal elements Non-diagonal elements The represents the balance coefficients for off-diagonal constraints. The first term is the first constraint, used to enhance semantic consistency, and the second term is the second constraint, used to reduce the correlation of redundant features.

[0084] It should be understood that the cross-correlation constraint mechanism reduces redundant information and background noise introduced by the student model during the distillation process by optimizing the correlation between feature dimensions, thereby enhancing the expressive power of key semantic features and avoiding scoring bias caused by feature coupling.

[0085] In the specific implementation process, to ensure that the student model maintains the structural relationships between different alarm samples in the feature space of the teacher model during training, and to enable the student model to inherit the teacher model's cognitive ability regarding the correlation structure and geometric relationships between different attack types, thereby improving the model's ability to identify complex attack chains and multi-stage attack behaviors, and enhancing the model's generalization performance in actual deployment scenarios, the construction of topological structure constraints based on the Gram matrix may include: Determine the first gram matrix corresponding to the high-level discriminative semantic representation and the second gram matrix corresponding to the aligned feature representation; Based on the first and second gram matrices, the topological constraints are determined.

[0086] It should be noted that the Gram matrix is ​​a matrix formed by performing inner product operations on the feature vectors of multiple samples in the same batch, and is used to represent the similarity structure relationship between samples in the feature space.

[0087] Understandably, the first Gram matrix is ​​constructed based on the high-level discriminative semantic representation of the teacher model, and is used to characterize the structural relationships between different alarm samples in the feature space of the teacher model. The second Gram matrix refers to the Gram matrix constructed based on the aligned feature representation of the student model, and is used to characterize the structural relationships between different alarm samples in the feature space of the student model.

[0088] In one example, the topology consistency loss is defined. for:

[0089] in, This is the first Gram matrix. Let this be the second Gram matrix. This constraint enables the student model to preserve the structural relationships between different alarm categories. Considering both the task objective and the distillation constraint, the final optimization objective is... ,in , These are the weighting coefficients. The task loss for the student model.

[0090] It should be understood that topological consistency constraints, by matching the structural relationships between the teacher model and the student model in the feature space, enable the student model to retain the correlation structure between different types of attacks, improve the ability to identify complex attack chains and multi-stage attack behaviors, and enhance the model's generalization performance.

[0091] Through the optimization process described above, the student model effectively inherits the discriminative ability of the teacher model while maintaining its lightweight nature. After training, only the student model is deployed on the network testbed nodes to score real-time alarm data. This model can achieve efficient inference under limited computing resources, meeting the needs of high-concurrency alarm processing.

[0092] Step S204: Optimize the parameters of the preset student model according to the constraints and training data to obtain the target student model.

[0093] It should be noted that the parameter optimization of the preset student model based on the constraints and training data can be achieved by constructing cross-correlation constraints and topological constraints based on the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the student model. These two constraints, along with the task loss of the student model itself, constitute the total loss, which is then used to optimize the parameters of the preset student model. The parameter optimization process is iterative. In each iteration, forward propagation, loss calculation, backpropagation, and parameter update are performed sequentially until the convergence condition is met. The converged student model is then used as the target student model.

[0094] In this embodiment, the multi-layer intermediate features of the student model are mapped to the high-level semantic space of the teacher model to obtain aligned feature representations. Then, constraints are constructed based on the two feature representations, and the parameters of the student model are optimized based on the training data, thereby ensuring that the trained target student model has high scoring accuracy while being lightweight.

[0095] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the network security alarm scoring method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0096] This application also provides a network security alarm scoring device, please refer to... Figure 5 The network security alarm scoring device includes: Module 10 is used to acquire network security alarm data to be scored; The input module 20 is used to input the network security alarm data into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data. The target student model is trained by the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the preset student model. The alignment feature representation is obtained by mapping the multi-layer intermediate feature representation of the preset student model to the semantic space where the high-level discriminative semantic representation of the teacher model is located through the projection mapping module.

[0097] The network security alarm scoring device provided in this application, employing the network security alarm scoring method described in the above embodiments, can solve the technical problem that traditional distillation methods lack effective feature decoupling mechanisms and cross-architecture adaptive mapping capabilities in network security alarm scoring scenarios, making it difficult for student models to inherit the teacher model's ability to discriminate complex attack behaviors. Compared with the prior art, the beneficial effects of the network security alarm scoring device provided in this application are the same as those of the network security alarm scoring method provided in the above embodiments, and other technical features in the network security alarm scoring device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0098] This application provides a network security alarm scoring device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the network security alarm scoring method in the above embodiment 1.

[0099] The following is for reference. Figure 6 The diagram illustrates a structural schematic suitable for implementing a network security alarm scoring device according to embodiments of this application. The network security alarm scoring device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The network security alarm scoring device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0100] like Figure 6 As shown, the network security alarm scoring device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the network security alarm scoring device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the network security alarm scoring device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows network security alarm scoring devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0101] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0102] The network security alarm scoring device provided in this application, employing the network security alarm scoring method described in the above embodiments, can solve the technical problem that traditional distillation methods lack effective feature decoupling mechanisms and cross-architecture adaptive mapping capabilities in network security alarm scoring scenarios, making it difficult for student models to inherit the teacher model's ability to discriminate complex attack behaviors. Compared with the prior art, the beneficial effects of the network security alarm scoring device provided in this application are the same as those of the network security alarm scoring method provided in the above embodiments, and other technical features in this network security alarm scoring device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0103] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0105] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the network security alarm scoring method in the above embodiments.

[0106] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0107] The aforementioned computer-readable storage medium may be included in the network security alarm scoring device; or it may exist independently and not be assembled into the network security alarm scoring device.

[0108] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the network security alarm scoring device, cause the network security alarm scoring device to perform the network security alarm scoring method described above.

[0109] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0110] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0111] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0112] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned network security alarm scoring method. This addresses the technical problem that traditional distillation methods in network security alarm scoring scenarios lack effective feature decoupling mechanisms and cross-architecture adaptive mapping capabilities, making it difficult for student models to inherit the teacher model's ability to discriminate complex attack behaviors. Compared to existing technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the network security alarm scoring method provided in the above embodiments, and will not be elaborated upon here.

[0113] The above description is only a part of the embodiments of this application and does not limit the scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included within the protection scope of this application.

[0114] It should be noted that the data collection, tag management, rule setting, and push decision-making processes involved in this application are designed to work with other technical features to solve technical problems. They do not involve or support any illegal activities. Any data processing that may violate laws and regulations (such as unauthorized collection of privacy data, generation of discriminatory tags, setting unfair rules, or pushing illegal information) is not within the scope of protection of this application's technical solution. Of course, the user data in this application will be encrypted, anonymized, or de-identified before storage to ensure user data security.

Claims

1. A network security alarm scoring method, characterized in that, The network security alarm scoring method includes: Obtain network security alert data to be scored; The network security alarm data is input into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data. The target student model is trained by the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the preset student model. The alignment feature representation is obtained by mapping the multi-layer intermediate feature representation of the preset student model to the semantic space where the high-level discriminative semantic representation of the teacher model is located through the projection mapping module.

2. The network security alarm scoring method as described in claim 1, characterized in that, Before inputting the network security alarm data into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data, the method further includes: Obtain a teacher model and a preset student model, and determine the high-level discriminative semantic representation of the teacher model and the multi-level intermediate feature representation of the preset student model; The multi-layer intermediate feature representation is mapped to the semantic space corresponding to the high-level discriminative semantic representation to obtain the aligned feature representation; Based on the high-level discriminative semantic representation and the alignment feature representation, construct the constraint conditions; The parameters of the preset student model are optimized based on the constraints and training data to obtain the target student model.

3. The network security alarm scoring method as described in claim 2, characterized in that, The constraints include cross-correlation constraints and topological constraints; The step of constructing constraints based on the high-level discriminative semantic representation and the alignment feature representation includes: The high-level discriminative semantic representation and the alignment feature representation are standardized to obtain the target high-level discriminative semantic representation and the target alignment feature representation. Based on the target high-level discriminative semantic representation and the target alignment feature representation, a cross-correlation matrix and a Gram matrix are constructed. Construct cross-correlation constraints based on the cross-correlation matrix; Construct topological constraints based on the stated Gram matrix.

4. The network security alarm scoring method as described in claim 3, characterized in that, The step of constructing cross-correlation constraints based on the cross-correlation matrix includes: The first constraint is determined based on the diagonal elements of the cross-correlation matrix; The second constraint is determined based on the off-diagonal elements of the cross-correlation matrix; Construct cross-correlation constraints based on the first constraint and the second constraint.

5. The network security alarm scoring method as described in claim 3, characterized in that, The construction of topological constraints based on the Gram matrix includes: Determine the first gram matrix corresponding to the high-level discriminative semantic representation and the second gram matrix corresponding to the aligned feature representation; Based on the first and second gram matrices, the topological constraints are determined.

6. The network security alarm scoring method as described in claim 2, characterized in that, Before obtaining the teacher model and the preset student model, and determining the high-level discriminative semantic representation of the teacher model and the multi-layer intermediate feature representation of the preset student model, the method further includes: Obtain the raw alarm log data generated by each node in the network test range; Multidimensional feature extraction is performed on the original alarm log data to obtain alarm feature data; The alarm feature data is associated with the corresponding labeled scores to obtain training data.

7. The network security alarm scoring method as described in claim 4, characterized in that, After associating the alarm feature data with the corresponding labeled scores to obtain training data, the process further includes: Map the alarm feature data in the training data into a multi-dimensional feature vector; With the goal of minimizing the difference between the predicted score and the labeled score in the training data, the teacher model is subjected to supervised fine-tuning training based on the multidimensional feature vector and the labeled score to obtain the teacher model.

8. A network security alarm scoring device, characterized in that, The device includes: The acquisition module is used to acquire network security alert data to be scored; The input module is used to input the network security alarm data into the pre-trained target student model to obtain the risk score corresponding to the network security alarm data. The target student model is trained by the high-level discriminative semantic representation of the teacher model and the alignment feature representation of the preset student model. The alignment feature representation is obtained by mapping the multi-layer intermediate feature representation of the preset student model to the semantic space where the high-level discriminative semantic representation of the teacher model is located through the projection mapping module.

9. A network security alarm scoring device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network security alarm scoring method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the network security alarm scoring method as described in any one of claims 1 to 7.

Images