A training method and a recognition method of an attack detection model

Abstract

The application discloses a kind of training method and identification method of attack detection model, wherein the training method obtains network traffic sample set, network traffic sample set includes several majority class samples and minority class samples;All majority class samples are subjected to kernel boundary perception undersampling, and several undersampling samples are obtained;According to all undersampling samples and / or majority class samples, carry out absence oversampling processing, and obtain several oversampling samples;Oversampling sample is used to represent the probability density value less than the low probability threshold space sampling sample, and the space sampling sample is the sampling sample in the sampling space corresponding to undersampling sample or majority class sample;All undersampling samples, oversampling samples and minority class samples are input into the initialized attack detection model to update parameters, and obtain the trained attack detection model.The method can effectively improve the accuracy and robustness of APT attack detection.The application relates to the field of industrial internet security technology.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, and in particular to a training method and identification method for an attack detection model. Background Technology

[0002] With the continuous advancement of smart grid and energy internet construction, advanced persistent threat (APT) attack detection has become a core requirement for ensuring the security of smart grid and energy internet.

[0003] Currently, related technologies are usually based on machine learning models to detect APT attacks in smart grids and the energy internet. However, due to the extreme imbalance of data samples in smart grids and the energy internet, the models trained in this way are not capable of identifying attack samples belonging to the minority class, and the accuracy of APT attack detection is unsatisfactory.

[0004] Therefore, the problems with the relevant technologies still need to be solved and optimized. Summary of the Invention

[0005] The purpose of this invention is to at least partially solve one of the technical problems existing in the related art.

[0006] Therefore, one objective of this invention is to provide an attack detection method and system, wherein the method can effectively improve the accuracy and robustness of APT attack detection.

[0007] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of this application include: In a first aspect, embodiments of this application provide a method for training an attack detection model, comprising: Obtain a network traffic sample set, which includes several majority class samples and minority class samples; Kernel boundary-aware undersampling is performed on all the majority class samples to obtain a number of undersampled samples; Based on all the undersampled samples and / or the majority class samples, absentee oversampling is performed to obtain a number of oversampled samples; the oversampled samples are used to characterize spatial samples with probability density values ​​less than a low probability threshold, and the spatial samples are samples in the sampling space corresponding to the undersampled samples or the majority class samples. All the undersampled samples, oversampled samples, and minority class samples are input into the initialized attack detection model for parameter update, resulting in a trained attack detection model.

[0008] In addition, the method according to the above embodiments of this application may also have the following additional technical features: Furthermore, in one embodiment of this application, the step of performing kernel boundary-aware undersampling on all the majority class samples to obtain a plurality of undersampled samples includes: Obtain the region sampling rules; Region classification is performed on all the majority class samples to obtain boundary sample regions, intermediate sample regions, and core sample regions; According to the region sampling rules, the boundary sample region, the intermediate sample region, and the core sample region are sampled according to the rules to obtain a number of undersampled samples.

[0009] Furthermore, in one embodiment of this application, the step of performing region classification on all the majority class samples to obtain boundary sample regions, intermediate sample regions, and core sample regions includes: Perform sample clustering on all the majority class samples to obtain several sample clusters, and a first quantile distance and a second quantile distance for each sample cluster, wherein the first quantile distance is less than the second quantile distance; For each of the sample clusters, a sample distance analysis is performed to obtain a sample distance group for each sample cluster; the sample distance group includes several sample distances, which are used to characterize the distance from the corresponding sample within the cluster to the center point of the sample cluster; Based on each of the first quantile distance, the second quantile distance, and the sample distance group, the corresponding sample clusters are classified by distance to obtain the boundary sample region, the intermediate sample region, and the core sample region.

[0010] Further, in one embodiment of this application, the step of performing distance classification on the corresponding sample clusters based on each first quantile distance, second quantile distance, and sample distance group to obtain the boundary sample region, the intermediate sample region, and the core sample region includes: The sample distances are compared based on the first quantile distance and the second quantile distance to obtain a distance comparison result; If the distance comparison result is that the sample distance is less than the first quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the core sample region; or, if the distance comparison result is that the sample distance is greater than or equal to the first quantile distance and the sample distance is less than or equal to the second quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the intermediate sample region; or, if the distance comparison result is that the sample distance is greater than the second quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the boundary sample region.

[0011] Furthermore, in one embodiment of this application, the step of performing absentee oversampling processing based on all the undersampled samples and / or the majority class samples to obtain a plurality of oversampled samples includes: All the undersampled samples are input into the initialized normalized flow model for model training to obtain the trained normalized flow model; All absent samples are input into the trained normalized flow model to perform probability density estimation, and the probability density value of each absent sample is obtained. The absent sample is either the undersampled sample or the majority class sample. Based on the probability density values ​​of all the missing samples, spatial sampling is performed on all the missing samples to obtain a number of oversampled samples.

[0012] Furthermore, in one embodiment of this application, the step of spatially sampling all the absent samples based on the probability density values ​​of all the absent samples to obtain a plurality of oversampled samples includes: The low probability threshold is determined based on the probability density values ​​of all the absent samples. The sampling space is obtained by constructing a spatial representation of all the absent samples. Based on the low probability threshold, spatial sampling is performed on the sampling space to obtain several oversampled samples.

[0013] Further, in this embodiment of the application, the step of spatially sampling the sampling space according to the low probability threshold to obtain a plurality of oversampled samples includes: Obtain the target sample quantity threshold; Random sampling is performed on the sampling space to obtain the spatial sampling sample; The spatial sample is input into the trained normalized flow model to estimate the probability density, thereby obtaining the probability density value of the spatial sample. If the probability density value of the spatial sample is less than the low probability threshold, the spatial sample is identified as the oversampled sample, and then the process returns to the step of randomly sampling the sampling space to obtain the spatial sample until the total number of oversampled samples is greater than or equal to the target sample number threshold.

[0014] Secondly, embodiments of this application provide a method for identifying attack detection models, including: Acquire network traffic data to be detected; The network traffic data is input into the trained attack detection model to perform attack detection and obtain the attack detection results.

[0015] Thirdly, embodiments of this application provide an attack detection system, including: The first processing unit is used to acquire a network traffic sample set, which includes several majority class samples and minority class samples; The second processing unit is used to perform kernel boundary-aware undersampling on all the majority class samples to obtain a number of undersampled samples. The third processing unit is used to perform absentee oversampling processing based on all the undersampled samples and / or the majority class samples to obtain a number of oversampled samples; the oversampled samples are used to characterize spatial sampling samples with probability density values ​​less than a low probability threshold, and the spatial sampling samples are sampling samples in the sampling space corresponding to the undersampled samples or the majority class samples. The fourth processing unit is used to input all the undersampled samples, the oversampled samples and the minority class samples into the initialized attack detection model for parameter update, so as to obtain the trained attack detection model.

[0016] Fourthly, embodiments of this application also provide an electronic device, including: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.

[0017] Fifthly, embodiments of this application also provide a computer-readable storage medium storing a processor-executable program, which, when executed by the processor, is used to implement the above-described method.

[0018] Sixthly, embodiments of this application also provide a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the method described above.

[0019] The advantages and beneficial effects of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application: This application discloses a training and identification method for an attack detection model. The training method involves acquiring a network traffic sample set, which includes several majority class samples and minority class samples. Kernel boundary-aware undersampling is performed on all majority class samples to obtain several undersampled samples. Absence oversampling is then performed on all undersampled samples and / or the majority class samples to obtain several oversampled samples. The oversampled samples represent spatial samples with probability density values ​​less than a low probability threshold; these spatial samples are samples in the sampling space corresponding to the undersampled samples or the majority class samples. All undersampled samples, oversampled samples, and minority class samples are input into an initialized attack detection model for parameter updates, resulting in a trained attack detection model. This method, based on undersampled samples and / or majority class samples obtained through kernel boundary-aware undersampling, performs absence oversampling to obtain oversampled samples. The attack detection model is then trained using a set of oversampled samples, undersampled samples, and minority class samples. This achieves sample data equalization, improving the model's ability to identify attack samples belonging to the minority class, thereby enhancing the model's accuracy in detecting APT attacks. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the following description is provided with accompanying drawings of the relevant technical solutions in the embodiments of this application or the prior art. It should be understood that the accompanying drawings described below are only for the purpose of clearly illustrating some embodiments of the technical solutions in this application. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0021] Figure 1 A flowchart illustrating a training method for an attack detection model provided in an embodiment of this application; Figure 2 A schematic diagram of the framework of a training system for an attack detection model provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0022] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0024] Currently, related technologies typically achieve APT attack detection based on rule-based or anomaly propagation methods or graph similarity. These methods often rely solely on a single detection result when making decisions, making them susceptible to accidental noise or single-point anomalies, which can lead to false alarms. Consequently, the accuracy and robustness of APT attack detection are unsatisfactory.

[0025] Currently, related technologies are usually based on machine learning models to detect APT attacks in smart grids and the energy internet. However, due to the extreme imbalance of data samples in smart grids and the energy internet, such as the fact that normal traffic accounts for the vast majority of network traffic data in smart grids while malicious traffic samples are scarce, traditional machine learning models are difficult to effectively identify APT attack behavior. In other words, the models trained in this way are not capable enough to identify attack samples that belong to the minority class, and the accuracy of APT attack detection is unsatisfactory.

[0026] It should be noted that the aforementioned related technologies are only used to assist in understanding the technical solutions of this application and do not mean that they belong to the publicly disclosed prior art.

[0027] In view of this, embodiments of this application provide a training method and an identification method for an attack detection model. The method is based on undersampled samples obtained by kernel boundary-aware undersampling. Specifically, it compresses the dataset by distinguishing the core sample region, intermediate sample region, and boundary sample region in the majority class samples, while combining subsequent region sampling rules to sample different sample regions. This can retain key samples that contribute to the classification decision boundary to the greatest extent, avoid information loss, and improve the quality of subsequent absent undersampling processing, thereby improving the model's detection accuracy for APT attacks.

[0028] Furthermore, this method obtains oversampled samples by performing absentee oversampling on undersampled samples and / or majority class samples. Specifically, a normalized flow model is trained using undersampled samples, enabling the trained model to learn the undersampled majority class distribution. Then, the probability density values ​​of the absent samples (undersampled samples and / or majority class samples) are estimated using the trained normalized flow model to determine the sampling space. Combined with subsequent spatial sampling based on a low probability threshold of the absent samples, this method can generate absent minority class samples that may represent unknown attacks by sampling in low-density regions (i.e., regions in the sampling space to which spatially sampled samples with probability density values ​​less than the low probability threshold belong). In other words, this method is not limited to the empirical distribution of existing minority class samples but can explore gaps in the majority class distribution, thereby generating new samples that may represent unknown APT attack variants or zero-day attacks, exhibiting stronger generalization ability.

[0029] It should be noted that some techniques process sample data by first oversampling and then undersampling. However, compared to the order of oversampling and then undersampling, this application compresses the majority class first and then enhances the minority class. This allows the normalized flow model to learn the majority class data after spatial redundancy removal (i.e., undersampled samples). This makes the probability density estimation of the normalized flow model more focused on the true boundary of the majority class, and the localization of low-density regions is more accurate. This is conducive to generating more effective absent minority class samples (i.e., oversampled samples).

[0030] By combining the training of attack detection models with subsequent sample sets based on oversampled samples, undersampled samples, and minority class samples, the model can achieve sample data equalization to improve its ability to identify attack samples belonging to the minority class, thereby improving the model's detection accuracy for APT attacks.

[0031] Reference Figure 1 In this embodiment of the application, a method for training an attack detection model includes: Step 110: Obtain a network traffic sample set, which includes several majority class samples and minority class samples; In this application embodiment, the majority class sample can be normal traffic data of the smart grid or energy internet in a historical time period; while the minority class sample can be malicious traffic data of the smart grid or energy internet in a historical time period that corresponds to the majority class sample. Specifically, the malicious traffic data can be network traffic data of the smart grid or energy internet under APT attack.

[0032] In one optional implementation, the acquired majority class and / or minority class samples can be preprocessed to obtain preprocessed majority class and / or minority class samples. Specifically, taking a majority class sample as an example, the preprocessing operation can first clean it by deleting data containing the special values ​​NaN and Inf. Then, the flow identifier (Flow ID), source IP address (Src IP), source port (Src Port), destination IP address (Dst IP), and flow timestamp feature columns are deleted. The remaining feature columns include the destination port (Dst Port) representing communication endpoint information, the flow duration representing network connection information, the total number of forward packets (Total Fwd Packets) and the total number of backward packets (Total Bwd Packets) representing data transmission volume information, the average time between two flows (Flow IAT Mean) and the standard deviation time between two flows (Flow IAT Std) representing transmission rate information, and the number of packets with FIN (FIN Flag Count) and the number of packets with SYN (SYN Flag) representing flow status flag information. The process involves identifying feature columns such as Count; then, normalizing these retained feature columns, and applying Principal Component Analysis (PCA) to the normalized feature columns for dimensionality reduction, resulting in several dimensionality-reduced feature columns. These dimensionality-reduced feature columns can serve as a preprocessed majority class sample. The preprocessing operations for the remaining majority or minority class samples are similar to those described above and can be easily deduced.

[0033] Step 120: Perform kernel boundary-aware undersampling on all the majority class samples to obtain several undersampled samples; In this embodiment of the application, undersampling based on kernel boundary awareness can be performed on all majority class samples. Undersampled samples are obtained by compressing the total number of majority class samples, that is, the total number of all undersampled samples is less than the total number of all majority class samples.

[0034] In some embodiments, performing kernel boundary-aware undersampling on all the majority class samples to obtain a plurality of undersampled samples includes: Obtain the region sampling rules; Region classification is performed on all the majority class samples to obtain boundary sample regions, intermediate sample regions, and core sample regions; Further, the step of performing region classification on all the majority class samples to obtain boundary sample regions, intermediate sample regions, and core sample regions includes: Perform sample clustering on all the majority class samples to obtain several sample clusters, and a first quantile distance and a second quantile distance for each sample cluster, wherein the first quantile distance is less than the second quantile distance; For each of the sample clusters, a sample distance analysis is performed to obtain a sample distance group for each sample cluster; the sample distance group includes several sample distances, which are used to characterize the distance from the corresponding sample within the cluster to the center point of the sample cluster; In this embodiment, sample clustering can be performed on all majority class samples using algorithms such as DBSCAN and K-Means clustering to obtain several sample clusters. For ease of understanding, this embodiment takes K-Means clustering of majority class samples as an example, thus determining that each sample cluster has a cluster center, which is denoted as the core in kernel boundary sensing. For any sample cluster, its quantile distance can be calculated by calculating the Euclidean distance from each majority class sample in the sample cluster to the corresponding cluster center, then sorting the Euclidean distances from each majority class sample to the corresponding cluster center from smallest to largest to obtain a sorted queue, and then determining the first quantile distance and the second quantile distance from the sorted queue based on the positional relationship.

[0035] For example, taking a sorted queue containing 100 Euclidean distances sorted from smallest to largest as an example, the first Euclidean distance in the sorted queue corresponds to the 1% quantile, the 60th Euclidean distance corresponds to the 60% quantile, the 90th Euclidean distance corresponds to the 90% quantile, and the quantiles corresponding to the remaining Euclidean distances can be deduced by analogy; the first quantile distance can be the 60% quantile, and the second quantile distance can be the 90% quantile.

[0036] Understandably, sample distance analysis can be performed by calculating the Euclidean distance from each majority class sample in the sample cluster to the corresponding cluster center, and then determining the Euclidean distance from each majority class sample to the corresponding cluster center as a sample distance, thereby obtaining a sample distance group.

[0037] Based on each of the first quantile distance, the second quantile distance, and the sample distance group, the corresponding sample clusters are classified by distance to obtain the boundary sample region, the intermediate sample region, and the core sample region.

[0038] Further, the step of performing distance classification on the corresponding sample clusters based on each of the first quantile distances, the second quantile distances, and the sample distance groups to obtain the boundary sample region, the intermediate sample region, and the core sample region includes: The sample distances are compared based on the first quantile distance and the second quantile distance to obtain a distance comparison result; If the distance comparison result is that the sample distance is less than the first quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the core sample region; Alternatively, if the distance comparison result is that the sample distance is greater than or equal to the first quantile distance and the sample distance is less than or equal to the second quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the intermediate sample region; Alternatively, if the distance comparison result is that the sample distance is greater than the second quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the boundary sample region.

[0039] In this embodiment of the application, for a sample distance in a certain sample distance group, distance classification can be achieved by comparing the magnitude relationship between the sample distance and the first quantile distance and the second quantile distance of the corresponding sample cluster, thereby obtaining the distance comparison result.

[0040] Specifically, if the distance comparison result is that the sample distance is less than the first quantile distance, it means that the majority class sample corresponding to the sample distance is close to the cluster center in its own sample cluster. The information redundancy of the majority class sample is high. At this time, the majority class sample (i.e. the sample within the cluster) corresponding to the sample distance can be marked as the core region sample, that is, the sample within the cluster corresponding to the sample distance belongs to the core sample region.

[0041] Alternatively, if the distance comparison result is that the sample distance is greater than or equal to the first quantile distance and less than the second quantile distance, it means that the majority class sample corresponding to the sample distance is neither close to the cluster center nor close to the cluster boundary of the sample cluster. In this case, the majority class sample (i.e. the sample within the cluster) corresponding to the sample distance can be marked as the intermediate region sample, that is, the sample within the cluster corresponding to the sample distance belongs to the intermediate sample region.

[0042] Alternatively, if the distance comparison result is that the sample distance is greater than the second quantile distance, it means that the majority class sample corresponding to the sample distance is close to the cluster boundary of the sample cluster. The majority class sample corresponding to the sample distance is critical to the classification decision boundary. In this case, the majority class sample (i.e. the sample within the cluster) corresponding to the sample distance can be marked as the boundary region sample, that is, the sample within the cluster corresponding to the sample distance belongs to the boundary sample region.

[0043] According to the region sampling rules, the boundary sample region, the intermediate sample region, and the core sample region are sampled according to the rules to obtain a number of undersampled samples.

[0044] In this embodiment, the regional sampling rule can be to retain all boundary region samples (100% retention rate), retain 50% of intermediate region samples, and retain only 20% of core region samples (i.e., discard 80% of redundant samples). Specifically, for boundary sample regions, rule sampling can be to determine each boundary region sample as an undersampled sample; for intermediate sample regions, rule sampling can be to randomly sample all intermediate region samples and determine the retained 50% of intermediate region samples as undersampled samples; and the rule sampling content for core sample regions is similar to that for intermediate sample regions and can be easily deduced, so it will not be described in detail here.

[0045] Step 130: Perform absentee oversampling processing based on all the undersampled samples and / or the majority class samples to obtain a number of oversampled samples; the oversampled samples are used to characterize spatial samples with probability density values ​​less than a low probability threshold, and the spatial samples are samples in the sampling space corresponding to the undersampled samples or the majority class samples. In this embodiment of the application, the absence oversampling process can generate absence minority class samples that may represent unknown attacks by learning the distribution of all undersampled samples and sampling in low-density areas of undersampled samples or majority class samples. These samples are referred to as oversampled samples.

[0046] In some embodiments, the absence oversampling process based on all the undersampled samples and / or the majority class samples to obtain a plurality of oversampled samples includes: All the undersampled samples are input into the initialized normalized flow model for model training to obtain the trained normalized flow model; All absent samples are input into the trained normalized flow model to perform probability density estimation, and the probability density value of each absent sample is obtained. The absent sample is either the undersampled sample or the majority class sample. In this embodiment, the normalized flow model can be composed of several (e.g., 4, 6, etc.) affine coupling layers stacked together. Each affine coupling layer uses a 5-layer fully connected network (each fully connected network includes 128 neurons, and the activation function uses ReLU activation function) as an approximator for the transformation function. Model training can be performed by inputting all undersampled samples into the initialized normalized flow model, maximizing the log-likelihood of the undersampled samples so that the model learns the probability density distribution of the undersampled samples, thereby obtaining a trained normalized flow model. There are various implementation methods for specific model training, which will not be elaborated here.

[0047] Understandably, in the first implementation, probability density estimation can be achieved by inputting all undersampled samples into a trained normalized flow model, and then outputting the probability density value of each undersampled sample under the learned probability density distribution through the trained normalized flow model.

[0048] In the second implementation, probability density estimation can be achieved by inputting all majority class samples into a trained normalized flow model, and then outputting the probability density value of each majority class sample under the learned probability density distribution through the trained normalized flow model.

[0049] Based on the probability density values ​​of all the missing samples, spatial sampling is performed on all the missing samples to obtain a number of oversampled samples.

[0050] Further, the step of spatially sampling all the absent samples based on their probability density values ​​to obtain a plurality of oversampled samples includes: The low probability threshold is determined based on the probability density values ​​of all the absent samples. The sampling space is obtained by constructing a spatial representation of all the absent samples. In this embodiment of the application, the probability densities of all absent samples can be sorted from smallest to largest, and the probability density value at the 5th percentile in the sorted probability density queue is determined as the low probability density value. This low probability threshold indicates that only 5% of the absent samples have a density lower than this value, which means that the region with a probability density value lower than the low probability threshold is the sparsest and most hollow region in the majority class distribution.

[0051] Understandably, the sampling space can be constructed based on the maximum and minimum values ​​of each feature column of each absent sample. For ease of understanding, taking the example where the majority class sample contains 10 feature columns, the corresponding absent sample also contains 10 feature columns. Therefore, the sampling space can be represented as:

[0052] in, A functional representation of the sampling space; This represents the total number of feature columns; As a variable; It is the minimum value of all absent samples in the j-th feature column, which is also the minimum dimension coordinate of the sampling space in the j-th dimension; It represents the maximum value of the missing sample in the j-th feature column, which is also the maximum dimension coordinate of the sampling space in the j-th dimension.

[0053] Based on the low probability threshold, spatial sampling is performed on the sampling space to obtain several oversampled samples.

[0054] Further, the step of spatially sampling the sampling space according to the low probability threshold to obtain a plurality of oversampled samples includes: Obtain the target sample quantity threshold; Random sampling is performed on the sampling space to obtain the spatial sampling sample; The spatial sample is input into the trained normalized flow model to estimate the probability density, thereby obtaining the probability density value of the spatial sample. If the probability density value of the spatial sample is less than the low probability threshold, the spatial sample is identified as the oversampled sample, and then the process returns to the step of randomly sampling the sampling space to obtain the spatial sample until the total number of oversampled samples is greater than or equal to the target sample number threshold.

[0055] In this embodiment, the target sample quantity threshold is the target number of new samples obtained through spatial sampling, which can be several times the number of minority class samples, such as twice the total number of minority class samples. Random sampling can be performed by uniformly random sampling within the sampling space, and the sampled points are determined as spatial sampling samples. Then, the spatial sampling samples are input into a trained normalized flow model, and the probability density of the spatial sampling samples is estimated by the trained normalized flow model to obtain the probability density value of the spatial sampling samples.

[0056] Understandably, for any given spatial sample, its probability density value can be compared to a low probability threshold. Specifically, if the probability density value of the spatial sample is greater than or equal to the low probability threshold, it indicates that the spatial sample does not belong to the sparsest and most empty region of the majority class distribution. In this case, the spatial sample can be deleted, and the process returns to the step of randomly sampling the sampling space to obtain the spatial sample. Alternatively, if the probability density value of the spatial sample is less than the low probability threshold, it indicates that the spatial sample belongs to the sparsest and most empty region of the majority class distribution, i.e., the spatial sample belongs to a low-density region. In this case, the spatial sample can be identified as an oversampled sample, and the process returns to the step of randomly sampling the sampling space to obtain the spatial sample, until the number of all oversampled samples is greater than or equal to the target sample number threshold.

[0057] Step 140: Input all the undersampled samples, the oversampled samples and the minority class samples into the initialized attack detection model to update the parameters and obtain the trained attack detection model.

[0058] In this embodiment, the attack detection model can be any one of the following: Logistic Regression, Perceptron, AdaBoost, Random Forest, etc. Step 140 can be to merge all undersampled samples, oversampled samples, and minority class samples to form a balanced training set, and then input this balanced training set into the initialized attack detection model for training. The model parameters are updated through training so that the model learns the traffic characteristics of the smart grid or energy internet under APT attacks, thereby obtaining a trained attack detection model. There are various methods for model training, such as using the backpropagation algorithm, which will not be elaborated here.

[0059] The method for identifying an attack detection model proposed in this application includes: Acquire network traffic data to be detected; The network traffic data is input into the trained attack detection model to perform attack detection and obtain the attack detection results.

[0060] In this embodiment of the application, network traffic data of the smart grid or energy internet at the current time can be obtained, and the network traffic data can be input into a trained attack detection model to obtain an attack detection result characterizing whether the smart grid or energy internet is subject to APT attacks.

[0061] Reference Figure 2 The training system for an attack detection model proposed in this application includes: The first processing unit 101 is used to acquire a network traffic sample set, which includes several majority class samples and minority class samples; The second processing unit 102 is used to perform kernel boundary-aware undersampling on all the majority class samples to obtain a number of undersampled samples. The third processing unit 103 is used to perform absentee oversampling processing based on all the undersampled samples and / or the majority class samples to obtain a number of oversampled samples; the oversampled samples are used to characterize spatial sampling samples with probability density values ​​less than a low probability threshold, and the spatial sampling samples are sampling samples in the sampling space corresponding to the undersampled samples or the majority class samples. The fourth processing unit 104 is used to input all the undersampled samples, the oversampled samples and the minority class samples into the initialized attack detection model for parameter update, so as to obtain the trained attack detection model.

[0062] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0063] Reference Figure 3 This application also provides an electronic device, including: At least one processor 201; At least one memory 202 is used to store at least one program; When the at least one program is executed by the at least one processor 201, the at least one processor 201 implements the method embodiment described above.

[0064] Similarly, it can be understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0065] This application also provides a computer-readable storage medium storing a program executable by a processor 201, which, when executed by the processor 201, is used to implement the above-described method embodiments.

[0066] Similarly, the content of the above method embodiments is applicable to the present computer-readable storage medium embodiments. The specific functions implemented by the present computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0067] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0068] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.

[0069] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0070] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional technology for an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0071] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0072] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0073] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0074] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0075] In the foregoing description of this specification, the references to terms such as "one embodiment," "another embodiment," or "some embodiments," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0076] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.

[0077] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A training method for an attack detection model, characterized in that, include: Obtain a network traffic sample set, which includes several majority class samples and minority class samples; Kernel boundary-aware undersampling is performed on all the majority class samples to obtain a number of undersampled samples; Based on all the undersampled samples and / or the majority class samples, absentee oversampling is performed to obtain a number of oversampled samples; the oversampled samples are used to characterize spatial samples with probability density values ​​less than a low probability threshold, and the spatial samples are samples in the sampling space corresponding to the undersampled samples or the majority class samples. All the undersampled samples, oversampled samples, and minority class samples are input into the initialized attack detection model for parameter update, resulting in a trained attack detection model.

2. The method according to claim 1, characterized in that, The step of performing kernel boundary-aware undersampling on all the majority class samples yields several undersampled samples, including: Obtain the region sampling rules; Region classification is performed on all the majority class samples to obtain boundary sample regions, intermediate sample regions, and core sample regions; According to the region sampling rules, the boundary sample region, the intermediate sample region, and the core sample region are sampled according to the rules to obtain a number of undersampled samples.

3. The method according to claim 2, characterized in that, The process of classifying all the majority class samples into regions to obtain boundary sample regions, intermediate sample regions, and core sample regions includes: Perform sample clustering on all the majority class samples to obtain several sample clusters, and a first quantile distance and a second quantile distance for each sample cluster, wherein the first quantile distance is less than the second quantile distance; For each of the sample clusters, a sample distance analysis is performed to obtain a sample distance group for each sample cluster; the sample distance group includes several sample distances, which are used to characterize the distance from the corresponding sample within the cluster to the center point of the sample cluster; Based on each of the first quantile distance, the second quantile distance, and the sample distance group, the corresponding sample clusters are classified by distance to obtain the boundary sample region, the intermediate sample region, and the core sample region.

4. The method according to claim 3, characterized in that, The step of classifying the corresponding sample clusters by distance based on each first quantile distance, second quantile distance, and sample distance group to obtain the boundary sample region, the intermediate sample region, and the core sample region includes: The sample distances are compared based on the first quantile distance and the second quantile distance to obtain a distance comparison result; If the distance comparison result is that the sample distance is less than the first quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the core sample region; or, if the distance comparison result is that the sample distance is greater than or equal to the first quantile distance and the sample distance is less than or equal to the second quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the intermediate sample region; or, if the distance comparison result is that the sample distance is greater than the second quantile distance, then the intra-cluster sample corresponding to the sample distance is assigned to the boundary sample region.

5. The method according to any one of claims 1-4, characterized in that, The absence oversampling process is performed based on all the undersampled samples and / or the majority class samples to obtain a number of oversampled samples, including: All the undersampled samples are input into the initialized normalized flow model for model training to obtain the trained normalized flow model; All absent samples are input into the trained normalized flow model to perform probability density estimation, and the probability density value of each absent sample is obtained. The absent sample is either the undersampled sample or the majority class sample. Based on the probability density values ​​of all the missing samples, spatial sampling is performed on all the missing samples to obtain a number of oversampled samples.

6. The method according to claim 5, characterized in that, The step of spatially sampling all the missing samples based on their probability density values ​​to obtain a plurality of oversampled samples includes: The low probability threshold is determined based on the probability density values ​​of all the absent samples. The sampling space is obtained by constructing a spatial representation of all the absent samples. Based on the low probability threshold, spatial sampling is performed on the sampling space to obtain several oversampled samples.

7. The method according to claim 6, characterized in that, The step of spatially sampling the sampling space according to the low probability threshold to obtain a plurality of oversampled samples includes: Obtain the target sample size threshold; Random sampling is performed on the sampling space to obtain the spatial sampling sample; The spatial sample is input into the trained normalized flow model to estimate the probability density, thereby obtaining the probability density value of the spatial sample. If the probability density value of the spatial sample is less than the low probability threshold, the spatial sample is identified as the oversampled sample, and then the process returns to the step of randomly sampling the sampling space to obtain the spatial sample until the total number of oversampled samples is greater than or equal to the target sample number threshold.

8. A method for identifying attack detection models, characterized in that, include: Acquire network traffic data to be detected; The network traffic data is input into the trained attack detection model as described in any one of claims 1-7 to perform attack detection and obtain the attack detection result.

9. A training system for an attack detection model, characterized in that, include: The first processing unit is used to acquire a network traffic sample set, which includes several majority class samples and minority class samples; The second processing unit is used to perform kernel boundary-aware undersampling on all the majority class samples to obtain a number of undersampled samples. The third processing unit is used to perform absentee oversampling processing based on all the undersampled samples and / or the majority class samples to obtain a number of oversampled samples; the oversampled samples are used to characterize spatial sampling samples with probability density values ​​less than a low probability threshold, and the spatial sampling samples are sampling samples in the sampling space corresponding to the undersampled samples or the majority class samples. The fourth processing unit is used to input all the undersampled samples, the oversampled samples and the minority class samples into the initialized attack detection model for parameter update, so as to obtain the trained attack detection model.

10. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any one of claims 1-8.

Images