Sample generation method and apparatus, and device and storage medium

Abstract

The present application relates to the technical field of computers, and specifically relates to a sample generation method and apparatus, and a device and a storage medium. The method comprises: obtaining a second sample on the basis of a first sample in a training set and a first generator; inputting both the first sample and the second sample into a first discriminator, so as to obtain a first discrimination result and a second discrimination result; on the basis of the first discrimination result and the second discrimination result, determining a first loss value, and training the first discriminator with the goal of minimizing the first loss value, so as to obtain a second discriminator; on the basis of a discrimination result which is output by the second discriminator, training the first generator to obtain a second generator, and then, on the basis of the other samples in the training set, cyclically training the second discriminator and the second generator until the number of times of training reaches a preset number of times or a preset termination condition is met, so as to obtain a target generator; and on the basis of the target generator and a plurality of preset malicious programs, obtaining a target sample set, wherein a target sample in the target sample set is used for training a malicious program identification model.

Description

Sample generation method, device and equipment and storage medium

[0001] Cross-reference to related applications

[0002] The present application claims priority to the Chinese patent application No. 202410659389.4, filed on May 24, 2024, and entitled "Sample generation method, device and equipment and storage medium", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0003] The present application relates to the technical field of computer, in particular to a sample generation method, device and equipment and storage medium. BACKGROUND

[0004] In order to prevent data leakage, privacy infringement, system paralysis and network infection, an abnormal program detection model can be used to identify abnormal programs. In order to make the abnormal program bypass the detection of the abnormal program detection model, the attacker will intentionally modify the abnormal program. In the prior art, samples for training the abnormal program detection model are usually generated based on heuristic ideas, for example, replacing the code of the abnormal program to obtain the sample. The sample obtained by this method has similar form and single content, and the detection effect of the trained abnormal program detection model is poor, which cannot well cope with the continuously evolving abnormal programs. Therefore, how to generate complex samples to improve the detection effect of the abnormal program detection model has become a problem to be solved. SUMMARY

[0005] The embodiments of the present application provide a sample generation method, device and equipment and storage medium for generating complex samples to improve the detection effect of the abnormal program detection model.

[0006] In a first aspect, the embodiments of the present application provide a sample generation method, which comprises:

[0007] obtaining a second sample based on a first sample in a training set and a first generator; each sample in the training set is an abnormal program with abnormal behavior collected in a network security detection scene;

[0008] inputting the first sample and the second sample into a first discriminator respectively to obtain a first discrimination result and a second discrimination result; determining a first loss value based on the first discrimination result and the second discrimination result, training the first discriminator with the first loss value as the target to obtain a second discriminator; the discriminator is used to judge the probability of the input sample being an abnormal program; the size of the first loss value is used to indicate the difference degree between the first sample and the second sample;

[0009] training the first generator based on a discrimination result output by the second discriminator to obtain a second generator, and then training the second discriminator and the second generator based on other samples in the training set until a preset number of training times is reached or a preset termination condition is met to obtain a target generator;

[0010] obtaining a target sample set based on the target generator and a plurality of preset abnormal programs, wherein a target sample in the target sample set is used to train an abnormal program recognition model.

[0011] In this solution, the first generator generates a second sample based on a first sample, determines a first loss value based on a first discriminator, the size of the first loss value is used to indicate the difference between the first sample and the second sample, and the first discriminator is trained to minimize the first loss value, that is, the first discriminator is trained to distinguish the difference between the sample generated by the first generator and the abnormal program, to obtain a second discriminator; the first generator is trained based on a discrimination result output by the second discriminator to obtain a second generator; the discriminator and the generator are continuously trained in this way until a target generator is obtained when the training is terminated. In the training process, the discriminator feeds back the difference between the sample generated by the generator and the abnormal program to the generator, and the generator learns the abnormal behavior of the abnormal program. Compared with the sample obtained by replacing the code of the abnormal program and other heuristic ideas, the target sample generated by the target generator may have abnormal behavior and be different from the original abnormal program, and has high complexity. When facing unknown abnormal programs, the abnormal program detection model trained based on the target sample has a high probability of detecting unknown abnormal programs, because it has learned more information about the abnormal program than the abnormal program detection model trained based on the sample obtained by the heuristic idea. Therefore, the detection effect of the abnormal program detection model trained based on the target sample is improved.

[0012] Optionally, the second sample is obtained based on the first sample and the first generator, and the method comprises:

[0013] altering at least one piece of data in the first sample to obtain the third sample;

[0014] inputting the third sample into the first generator to obtain the second sample.

[0015] Through this way, the sample input into the first generator is a sample in which the abnormal program is altered, and the second sample obtained by inputting the third sample into the first generator has a greater possibility of change than the sample obtained by inputting the first sample into the first generator. Therefore, the target sample has a large difference from the samples in the training set, and has high complexity.

[0016] Optionally, the training of the first generator based on the discrimination result output by the second discriminator obtains a second generator, and the method further comprises:

[0017] inputting the second sample into the second discriminator to obtain a third discrimination result;

[0018] determining a second loss value based on the third discrimination result, and training the first generator to obtain the second generator with the second loss value being minimized; the size of the second loss value is used to indicate the difference degree between the second sample and the abnormal program.

[0019] By the method, the first generator is trained with the second loss value being minimized, that is, the first generator is trained to generate the abnormal program identified by the second discriminator, and the second generator has a greater possibility of abnormal behavior than the sample generated by the first generator, and the training effect is good.

[0020] Optionally, the training of the first generator based on the discrimination result output by the second discriminator obtains a second generator, and the method further comprises:

[0021] inputting the first sample into the first generator to obtain a fourth sample;

[0022] inputting the fourth sample into the second discriminator to obtain a fourth discrimination result;

[0023] inputting the third discrimination result and the fourth discrimination result into a preset first loss function respectively to obtain a first sub-loss value and a second sub-loss value;

[0024] taking the sum of the first sub-loss value and the second sub-loss value as the second loss value.

[0025] By the method, the first generator is trained to generate the abnormal program identified by the second discriminator, and the third discrimination result and the fourth discrimination result can both reflect the difference between the sample generated by the first generator and the abnormal program identified by the second discriminator, and the second generator obtained by the first generator in the training process according to the first sub-loss value and the second sub-loss value has a good effect, and the second generator has a greater possibility of abnormal behavior than the sample generated by the first generator.

[0026] Optionally, the training of the first generator based on the discrimination result output by the second discriminator obtains a second generator, and the method further comprises:

[0027] inputting the second sample into a third generator to obtain a fifth sample; the third generator is used to restore the sample generated by the first generator;

[0028] inputting the third discrimination result into a preset first loss function to obtain a first sub-loss value, and inputting the fifth sample and the third sample into a preset second loss function to obtain a third sub-loss value; the third sub-loss value is used to indicate a difference degree between the fifth sample and the third sample;

[0029] determining the second loss value according to the first sub-loss value and the third sub-loss value.

[0030] According to the third sample and the fifth sample, the third sub-loss value is obtained, and the size of the third sub-loss value is used to indicate the difference degree between the fifth sample and the third sample. In other words, the third sub-loss value reflects the stability of the first generator and the third generator. The smaller the third sub-loss value is, the stronger the stability of the first generator and the third generator is, the smaller the error introduced in the data conversion process is, and the less the distortion is. Therefore, the possibility of the sample obtained by the second generator losing effective information is small, the second generator has a good effect, and the possibility of the sample generated by the second generator having abnormal behavior is large.

[0031] Optionally, the target sample set is obtained based on the target generator and a plurality of preset true abnormal samples, and the method comprises:

[0032] inputting the plurality of preset abnormal programs into the target generator respectively to obtain a candidate sample set; the candidate sample set comprises a plurality of candidate samples; determining a similarity degree between any two candidate samples in the candidate sample set according to a vector corresponding to each candidate sample; the vector corresponding to each candidate sample indicates an abnormal behavior of the candidate sample;

[0033] selecting the target sample set from the candidate sample set based on the similarity degree between the any two candidate samples; a similarity degree between any two target samples in the target sample set is less than a threshold value.

[0034] According to the third sample and the fifth sample, the third sub-loss value is obtained, and the size of the third sub-loss value is used to indicate the difference degree between the fifth sample and the third sample. In other words, the third sub-loss value reflects the stability of the first generator and the third generator. The smaller the third sub-loss value is, the stronger the stability of the first generator and the third generator is, the smaller the error introduced in the data conversion process is, and the less the distortion is. Therefore, the possibility of the sample obtained by the second generator losing effective information is small, the second generator has a good effect, and the possibility of the sample generated by the second generator having abnormal behavior is large.

[0035] In a second aspect, an embodiment of the present application is a sample generation device, which comprises a module / unit / technical means for executing the method in the first aspect or any of the optional embodiments of the first aspect.

[0036] For example, the device can comprise:

[0037] an obtaining module, configured to obtain a second sample based on a first sample in a training set and a first generator; each sample in the training set is an abnormal program with abnormal behavior collected in a network security detection scenario;

[0038] a processing module, configured to input the first sample and the second sample into a first discriminator respectively to obtain a first discrimination result and a second discrimination result; determine a first loss value based on the first discrimination result and the second discrimination result, train the first discriminator with the first loss value as a target to obtain a second discriminator; the discriminator is used to judge a probability of an input sample being an abnormal program; the size of the first loss value is used to indicate a difference degree between the first sample and the second sample; train the first generator based on a discrimination result output by the second discriminator to obtain a second generator, and then train the second discriminator and the second generator based on other samples in the training set in a cycle until a preset number of training times is reached or a preset termination condition is met to obtain a target generator; obtain a target sample set based on the target generator and a plurality of preset abnormal programs; wherein a target sample in the target sample set is used to train an abnormal program recognition model.

[0039] Optionally, when the obtaining module obtains the second sample based on the first sample in the training set and the first generator, the obtaining module is specifically configured to:

[0040] modify at least one data in the first sample to obtain the third sample;

[0041] input the third sample into the first generator to obtain the second sample.

[0042] Optionally, when the processing module trains the first generator based on the discrimination result output by the second discriminator to obtain the second generator, the processing module is specifically configured to:

[0043] input the second sample into the second discriminator to obtain a third discrimination result;

[0044] determine a second loss value based on the third discrimination result, and train the first generator to obtain the second generator with the second loss value as a target; the size of the second loss value is used to indicate a difference degree between the second sample and an abnormal program.

[0045] Optionally, when the processing module determines the second loss value based on the third discrimination result and trains the first generator to obtain the second generator with the second loss value as a target, the processing module is specifically configured to:

[0046] input the first sample into the first generator to obtain a fourth sample;

[0047] inputting the fourth sample into the second discriminator to obtain a fourth discrimination result;

[0048] inputting the third discrimination result and the fourth discrimination result into a preset first loss function respectively to obtain a first sub-loss value and a second sub-loss value;

[0049] taking a sum of the first sub-loss value and the second sub-loss value as the second loss value.

[0050] Optionally, when the processing module determines a second loss value based on the third discrimination result, trains the first generator to obtain the second generator with the second loss value being minimum as a target, and specifically is configured to:

[0051] inputting the second sample into a third generator to obtain a fifth sample; the third generator is configured to restore the sample generated by the first generator;

[0052] inputting the third discrimination result into a preset first loss function to obtain a first sub-loss value, and inputting the fifth sample and the third sample into a preset second loss function to obtain a third sub-loss value; the third sub-loss value is used to indicate a difference degree between the fifth sample and the third sample;

[0053] determining the second loss value according to the first sub-loss value and the third sub-loss value.

[0054] Optionally, when the processing module obtains a target sample set based on the target generator and a plurality of preset abnormal samples, and specifically is configured to:

[0055] inputting the plurality of preset abnormal programs into the target generator to obtain a candidate sample set; the candidate sample set includes a plurality of candidate samples; determining a similarity degree between any two candidate samples in the candidate sample set according to a vector corresponding to each candidate sample; the vector corresponding to each candidate sample indicates an abnormal behavior of the each candidate sample;

[0056] selecting the target sample set from the candidate sample set based on the similarity degree between the any two candidate samples; a similarity degree between any two target samples in the target sample set is less than a threshold.

[0057] In a third aspect, an electronic device is provided, including: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the at least one processor executes steps of the sample generation method in the first aspect by executing the instructions stored in the memory.

[0058] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program. The computer program comprises program instructions. When the program instructions are executed by a computer, the computer is caused to perform the steps of the sample generation method in the first aspect.

[0059] In addition, other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and attained by the structure particularly pointed out in the written description and claims thereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained from the provided drawings without creative labor.

[0061] FIG. 1 is a flowchart of a sample generation method provided by an embodiment of the present application;

[0062] FIG. 2 is a schematic diagram of training a first discriminator provided by an embodiment of the present application;

[0063] FIG. 3 is a schematic diagram of training a first discriminator provided by another embodiment of the present application;

[0064] FIG. 4 is a schematic diagram of training a first generator provided by an embodiment of the present application;

[0065] FIG. 5 is a schematic diagram of training a first generator provided by another embodiment of the present application;

[0066] FIG. 6 is a schematic diagram of training a first generator provided by another embodiment of the present application;

[0067] FIG. 7 is a schematic diagram of a target sample acquisition method provided by an embodiment of the present application;

[0068] FIG. 8 is a structural diagram of a sample generation device provided by an embodiment of the present application;

[0069] FIG. 9 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0070] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work belong to the protection scope of the present application. The embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily without conflict. Moreover, although the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in different order from the order herein.

[0071] The terms "first" and "second" in the specification and claims of the present application and the above drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device. "Multiple" in the present application can mean at least two, for example, can be two, three or more, and the embodiments of the present application are not limited.

[0072] In addition, the term "and / or" herein is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character "three" in this paper, without special description, generally means that the associated objects before and after are a "or" relationship.

[0073] In order to facilitate the understanding of the scheme of the embodiments of the present application, the possible application scenarios of the embodiments of the present application will be introduced first.

[0074] Abnormal programs are programs with abnormal behaviors such as unauthorized access, with attack intention, which can cause data leakage, privacy invasion, system paralysis and network infection, and can be identified by using an abnormal program detection model. In the prior art, samples for training the abnormal program detection model are usually generated based on heuristic ideas, for example, replacing the code of the abnormal program to obtain the sample. The sample obtained by this method is similar in form and single in content, and the detection effect of the trained abnormal program detection model is poor, which cannot well cope with the constantly evolving abnormal programs.

[0075] In view of this, the technical solutions of the embodiments of the present application are provided to generate a sample that may have abnormal behavior and is different from the original abnormal program. The sample has more differences compared with the original abnormal program and has high complexity. The abnormal program detection model trained according to the sample learns more information about the abnormal program, thereby improving the detection effect of the abnormal program detection model.

[0076] Referring to FIG. 1, a flowchart of a sample generation method provided by the embodiments of the present application is shown. The method can be executed by a computer device such as a notebook computer, a desktop computer, a server, and the like, and can also be applied to various devices with computing capabilities. The above devices are only examples and the embodiments of the present application are not limited thereto.

[0077] In the embodiments of the present application, the sample generation method provided by the present application is used to generate a target sample to train an abnormal program detection model. The method is applied to an abnormal program detection technology, which can be applied to a network security detection tool and other business scenarios that need to detect abnormal programs. The embodiments of the present application are not limited thereto.

[0078] The generator in the embodiments of the present application is a deep neural network, and the discriminator is a binary classification deep neural network. The input layer and the output layer of the generator and the input layer of the discriminator each include a plurality of neurons. The number of the plurality of neurons is related to the bit sequence corresponding to the sample. For example, if the sample includes 2000 bits, the number of the plurality of neurons is 2000. The output layer of the discriminator includes two neurons.

[0079] Based on the above scenario and the description of the structure of the generator and the discriminator, the method provided by the embodiments of the present application can specifically include the following implementation steps:

[0080] S101: obtaining a second sample based on a first sample in a training set and a first generator.

[0081] Each sample in the training set is an abnormal program with abnormal behavior collected in a network security detection scenario.

[0082] In one possible implementation, referring to FIG. 2, the first sample is input into the first generator to obtain the second sample.

[0083] Through this method, the second sample is obtained according to the first sample, and the first sample is obtained in a simple manner.

[0084] In another possible implementation, referring to FIG. 3, at least one data in the first sample is modified to obtain a third sample; and the third sample is input into the first generator to obtain the second sample.

[0085] It can be understood that the number of data to be modified can be specified according to actual needs, and the data to be modified can be data at any position in the first sample, and the embodiments of the application are not limited.

[0086] Through the method, the sample input into the first generator is the sample modified from the abnormal program, and compared with the sample obtained by inputting the first sample into the first generator, the second sample obtained by inputting the third sample into the first generator has a greater possibility of change, and the sample generated by the first generator after training has greater difference and higher complexity from the sample in the training set.

[0087] S102: input the first sample and the second sample into the first discriminator respectively to obtain a first discrimination result and a second discrimination result; determine a first loss value based on the first discrimination result and the second discrimination result, train the first discriminator with the minimum first loss value as the target, and obtain the second discriminator.

[0088] The discriminator is used to judge the probability of the input sample being an abnormal program, and the probability value is between 0 and 1, for example, the first discrimination result is 0.9, that is, the first discriminator judges that the probability of the first sample being an abnormal program is 0.9; the size of the first loss value is used to indicate the difference between the first sample and the second sample, and when the first loss value is the smallest, the difference between the first sample and the second sample is the largest, and the first discriminator is trained to distinguish the difference between the sample generated by the first generator and the abnormal program.

[0089] The determination method of the first loss value is introduced below.

[0090] In one possible implementation, the method of obtaining the second sample shown in FIG. 2 in S101 is used, after the first discrimination result and the second discrimination result are obtained, the first discrimination result and the second discrimination result are input into the calculation formula of the first loss value, and the calculation formula of the first loss value can be represented by the following formula (1), and the dashed line in FIG. 2 represents that the first discriminator is trained according to the first loss value.

[0091] Wherein, loss1 represents the first loss value, E represents the expectation, X represents the first sample, D1(X) represents the first discrimination result, Y represents the second sample, and D1(Y) represents the second discrimination result.

[0092] In another possible implementation, the first sample is input into the first generator to obtain a fourth sample in the manner of obtaining the second sample shown in FIG. 3 in S101, and the fourth sample is input into the first discriminator; the first discrimination result, the second discrimination result, and a discrimination result of the first discriminator for the fourth sample are input into a calculation formula of the first loss value, and the calculation formula of the first loss value can be represented by the following formula (2), and the dashed line in FIG. 3 represents that the first discriminator is trained according to the first loss value.

[0093] wherein Z represents the third sample, D1(G1(X)) represents the discrimination result of the first discriminator D1 for the fourth sample, and G1(Z) represents the second sample.

[0094] S103: training the first generator based on the discrimination result output by the second discriminator to obtain a second generator, and then cyclically training the second discriminator and the second generator based on other samples in the training set until a preset number of training times is reached or a preset termination condition is met to obtain a target generator.

[0095] The preset termination condition is that, in adjacent two training processes, after a sample generated by the generator is input into the discriminator, a difference between the discrimination result output by the discriminator and 0.5 is within a set value, 0.5 represents that the discriminator confirms that the probability of the sample being an abnormal program or the probability of the sample being a non-abnormal program is the same, at this time, the discriminator cannot distinguish the difference between the sample generated by the generator and the abnormal program.

[0096] Since the samples in the training set are all abnormal programs, in the cyclic training process, the generator continuously learns the abnormal behaviors of the abnormal programs, and finally the target sample generated by the target generator has a high possibility of exhibiting abnormal behaviors.

[0097] The following describes a method of training the first generator based on the discrimination result output by the second discriminator to obtain the second generator.

[0098] The second sample is input into the second discriminator to obtain a third discrimination result, a second loss value is determined based on the third discrimination result, and the first generator is trained to obtain the second generator with the minimum second loss value as a target; the size of the second loss value is used to indicate the difference degree between the second sample and the abnormal program, and the difference degree between the second sample and the abnormal program is the smallest when the second loss value is the smallest.

[0099] Further, the second loss value can be determined in the following manner.

[0100] In the manner 1, as shown in FIG. 4, after the second sample is input into the second discriminator to obtain the third discrimination result, the third discrimination result is input into the calculation formula of the second loss value, and the calculation formula of the second loss value can be expressed as formula (3). The dashed line in FIG. 4 represents that the first generator is trained according to the second loss value. The second discriminator in the manner 1 can be obtained according to the manners shown in FIG. 2 or FIG. 3 in S102.

[0101] Wherein, loss2 represents the second loss value, and D2(Y) represents the third discrimination result.

[0102] According to the manner, the second loss value is directly obtained according to the third discrimination result, and the manner is simple and easy to implement.

[0103] In the manner 2, the manner of training the first discriminator shown in FIG. 3 in S102 is used. As shown in FIG. 5, the second sample is input into the second discriminator to obtain the third discrimination result, the first sample is input into the first generator to obtain the fourth sample, the fourth sample is input into the second discriminator to obtain the fourth discrimination result, the third discrimination result and the fourth discrimination result are respectively input into the preset first loss function to obtain the first sub-loss value and the second sub-loss value, and the sum of the first sub-loss value and the second sub-loss value is taken as the second loss value. The dashed line in FIG. 5 represents that the first generator is trained according to the second loss value.

[0104] The preset first sub-loss function can be expressed as formula (4).

[0105] loss21=E[-log(-T))] (4)

[0106] Wherein, T represents the discrimination result, when T is the third discrimination result, loss21 is the first sub-loss value, and when T is the fourth discrimination result, loss21 is the second sub-loss value.

[0107] The calculation formula of the second loss value can be expressed as formula (5).

[0108] Wherein, D2(G1(X)) represents the fourth discrimination result.

[0109] According to the manner, the first generator is trained to generate the abnormal program recognized by the second discriminator. The third discrimination result and the fourth discrimination result can both reflect the difference between the sample generated by the first generator and the abnormal program recognized by the second discriminator. The first generator is trained according to the first sub-loss value and the second sub-loss value in the first training process, and the second generator obtained has good effect. The sample generated by the second generator has a high possibility of abnormal behavior.

[0110] In mode 3, the first discriminator is trained in the manner shown in FIG. 3 in S102, as shown in FIG. 6, the second sample is input into the second discriminator to obtain a third discrimination result, and the second sample is input into the third generator to obtain a fifth sample; the third generator is used to restore the sample generated by the first generator; the third discrimination result is input into a preset first loss function to obtain a first sub-loss value, and the fifth sample and the third sample are input into a preset second loss function to obtain a third sub-loss value; the size of the third sub-loss value is used to indicate the difference between the fifth sample and the third sample; the second loss value is determined according to the first sub-loss value and the third sub-loss value, and the dashed line in FIG. 6 indicates that the first generator is trained according to the second loss value.

[0111] The preset second sub-loss function can be represented by the following formula (6).

[0112] loss22 = E[(G3(Y) - Z) 2 ] (6)

[0113] Wherein, loss22 represents the third sub-loss value, and G3(Y) represents the fifth sample generated by the third generator for the second sample.

[0114] The calculation formula of the second loss value can be represented by the following formula (7).

[0115] Wherein, a and b are hyperparameters, and a and b are added to 1.

[0116] According to the third sample and the fifth sample, the third sub-loss value is obtained, the size of the third sub-loss value is used to indicate the difference between the fifth sample and the third sample, in other words, the third sub-loss value reflects the stability of the first generator and the third generator, the smaller the third sub-loss value, the stronger the stability of the first generator and the third generator, the smaller the error introduced in the data conversion process, the less the distortion, and the less the possibility of losing effective information of the sample obtained by the second generator, the better the effect of the second generator, and the greater the possibility of abnormal behavior of the sample generated by the first generator.

[0117] The above-mentioned mode 2 and mode 3 can also be combined, that is, the first sub-loss value is determined according to the above-mentioned mode 2 or mode 3, the second sub-loss value is determined according to the above-mentioned mode 2, the third sub-loss value is determined according to the above-mentioned mode 3, and the second loss value is determined according to the first sub-loss value, the second sub-loss value and the third sub-loss value. The calculation formula of the second loss value can be represented by the following formula (8).

[0118] By the method, the second loss value is determined according to the first sub-loss value, the second sub-loss value and the third sub-loss value, the second loss value is rich in information, and the second generator has a good effect, and the generated sample has a high possibility of abnormal behavior compared with the sample generated by the first generator.

[0119] In S104, a target sample set is obtained based on the target generator and the plurality of preset abnormal programs.

[0120] In the target sample set, the target samples are used to train the abnormal program recognition model.

[0121] In a possible implementation, each preset abnormal program in the plurality of preset abnormal programs is input into the target generator to obtain a plurality of target samples that constitute the target sample set.

[0122] In another possible implementation, the plurality of preset abnormal programs are input into the target generator to obtain a candidate sample set; the candidate sample set includes a plurality of candidate samples; a similarity degree between any two candidate samples in the candidate sample set is determined according to a vector corresponding to each candidate sample; the vector corresponding to each candidate sample indicates an abnormal behavior of each candidate sample; the target sample set is selected from the candidate sample set based on the similarity degree between any two candidate samples, and a similarity degree between any two target samples in the target sample set is less than a threshold.

[0123] Optionally, the vector corresponding to each candidate sample is determined by an initial abnormal program recognition model. The initial abnormal program recognition model is trained based on the plurality of preset abnormal programs and a plurality of preset non-abnormal programs, the non-abnormal programs are programs collected in a network security detection scene and do not have abnormal behaviors, the initial abnormal program recognition model has a feature extraction layer and an output layer, each candidate sample is input into the initial abnormal program recognition model, the feature extraction layer is used to extract the vector corresponding to each candidate sample, and the output layer is used to determine whether each candidate sample is an abnormal program according to the vector corresponding to each candidate sample.

[0124] Optionally, when the similarity degree between any two candidate samples is determined, a t-SNE dimension reduction algorithm is used to convert the vector in a high-dimensional space into a two-dimensional coordinate. Normalization is performed on the two-dimensional coordinates corresponding to all vectors, that is, each candidate sample is mapped to an arc of a unit circle with (0, 0) as the center. A circular arc is obtained according to the two-dimensional coordinates corresponding to any two candidate samples, and the similarity degree between any two candidate samples is represented by the reciprocal of the central angle of the circular arc.

[0125] Optionally, after determining the similarity degree of any two candidate samples, the plurality of candidate sample sets can be divided into a plurality of groups according to the similarity degree of any two candidate samples, the similarity degree between candidate samples in the same group is within a preset range, the similarity degree between candidate samples in different groups is outside the preset range, and a preset number of candidate samples are taken in each of the plurality of groups to obtain the target sample set.

[0126] For example, as shown in FIG. 7, after mapping each candidate sample to an arc of a unit circle with (0, 0) as the center, the unit circle is divided into a plurality of regions, each region corresponds to a central angle of 2 degrees, samples in the same region are in the same group, and a preset number of candidate samples are taken in each region to sample the target sample set.

[0127] Through the above manner, the target sample set is obtained by the target generator, the similarity degree of any two candidate samples is determined according to the vector corresponding to each candidate sample, and the target sample set is selected from the candidate sample set. The target sample is equivalent to a representative sample in the candidate sample set, and the number of samples in the target sample set is less than that in the candidate sample set. Therefore, the training effect of the abnormal program recognition model is ensured, and the training efficiency of the abnormal program recognition model is improved.

[0128] In the above schemes S101-S104, the first generator generates the second sample based on the first sample, determines the first loss value based on the first discriminator, the size of the first loss value is used to indicate the difference degree between the first sample and the second sample, the first discriminator is trained with the minimum first loss value as the target, that is, the first discriminator is trained to distinguish the difference between the sample generated by the first generator and the abnormal program, and the second discriminator is obtained; the first generator is trained based on the discrimination result output by the second discriminator, and the second generator is obtained; the discriminator and the generator are continuously trained in this way until the target generator is obtained when the training is terminated. In the training process, the discriminator feeds back the difference between the sample generated by the generator and the abnormal program to the generator. The generator learns the abnormal behavior of the abnormal program. Compared with the sample obtained by replacing the code of the abnormal program and other heuristic ideas, the target sample generated by the target generator may have abnormal behavior and be different from the original abnormal program, and has high complexity. When facing unknown abnormal programs, since the abnormal program detection model trained according to the target sample learns more information about the abnormal program than the abnormal program detection model trained according to the sample obtained by the heuristic idea, the probability of detecting unknown abnormal programs is high. The detection effect of the abnormal program detection model trained according to the target sample is improved.

[0129] The above introduces the method provided by the embodiments of the present application, and the following introduces the device provided by the embodiments of the present application.

[0130] With reference to FIG. 8, based on the same inventive concept, an embodiment of the present application provides a classification model updating apparatus.

[0131] Exemplarily, the apparatus 800 comprises:

[0132] The obtaining module 801 is configured to obtain a second sample based on a first sample in a training set and a first generator; each sample in the training set is an abnormal program with abnormal behavior collected in a network security detection scenario;

[0133] The processing module 802 is configured to input the first sample and the second sample into a first discriminator respectively to obtain a first discrimination result and a second discrimination result; determine a first loss value based on the first discrimination result and the second discrimination result, train the first discriminator with the first loss value as a target to obtain a second discriminator; the discriminator is used to judge a probability of an input sample being an abnormal program; the size of the first loss value is used to indicate a difference degree between the first sample and the second sample; train the first generator based on a discrimination result output by the second discriminator to obtain a second generator, and then train the second discriminator and the second generator based on other samples in the training set in a cycle until a preset number of training times is reached or a preset termination condition is met to obtain a target generator; obtain a target sample set based on the target generator and a plurality of preset abnormal programs; wherein a target sample in the target sample set is used to train an abnormal program recognition model.

[0134] Optionally, when obtaining the second sample based on the first sample in the training set and the first generator, the obtaining module 801 is specifically configured to:

[0135] modify at least one data in the first sample to obtain the third sample;

[0136] input the third sample into the first generator to obtain the second sample.

[0137] Optionally, when training the first generator based on the discrimination result output by the second discriminator to obtain the second generator, the processing module 802 is specifically configured to:

[0138] input the second sample into the second discriminator to obtain a third discrimination result;

[0139] determine a second loss value based on the third discrimination result, and train the first generator to obtain the second generator with the second loss value as a target; the size of the second loss value is used to indicate a difference degree between the second sample and an abnormal program.

[0140] Optionally, the processing module 802 is configured to determine a second loss value based on the third discrimination result, train the first generator to obtain the second generator by taking the second loss value as a target, and specifically configured to:

[0141] input the first sample into the first generator to obtain a fourth sample;

[0142] input the fourth sample into the second discriminator to obtain a fourth discrimination result;

[0143] input the third discrimination result and the fourth discrimination result into a preset first loss function respectively to obtain a first sub-loss value and a second sub-loss value;

[0144] take a sum of the first sub-loss value and the second sub-loss value as the second loss value.

[0145] Optionally, the processing module 802 is configured to determine a second loss value based on the third discrimination result, train the first generator to obtain the second generator by taking the second loss value as a target, and specifically configured to:

[0146] input the second sample into a third generator to obtain a fifth sample; the third generator is configured to restore the sample generated by the first generator;

[0147] input the third discrimination result into a preset first loss function to obtain a first sub-loss value, and input the fifth sample and the third sample into a preset second loss function to obtain a third sub-loss value; the third sub-loss value is used to indicate a difference degree between the fifth sample and the third sample;

[0148] determine the second loss value according to the first sub-loss value and the third sub-loss value.

[0149] Optionally, the processing module 802 is configured to determine a target sample set based on the target generator and a plurality of preset abnormal samples, and specifically configured to:

[0150] input the plurality of preset abnormal programs into the target generator to obtain a candidate sample set; the candidate sample set includes a plurality of candidate samples; determine a similarity degree between any two candidate samples in the candidate sample set according to a vector corresponding to each candidate sample; the vector corresponding to each candidate sample indicates an abnormal behavior of the each candidate sample;

[0151] select the target sample set from the candidate sample set based on the similarity degree between the any two candidate samples; a similarity degree between any two target samples in the target sample set is less than a threshold value.

[0152] As a possible product form of the above device, referring to FIG. 9, the embodiment of the present application further provides an electronic device 900, comprising:

[0153] at least one processor 901; and a communication interface 903 connected with the at least one processor 901; the at least one processor 901 executes the instructions stored in the memory 902, so that the electronic device 900 executes the method in the embodiment shown in FIG. 3 through the communication interface 903.

[0154] Optionally, the memory 902 is located outside the electronic device 900.

[0155] Optionally, the electronic device 900 comprises the memory 902, the memory 902 is connected with the at least one processor 901, and the memory 902 stores instructions executable by the at least one processor 901. FIG. 9 shows that the memory 902 is optional for the electronic device 900 with a dashed line.

[0156] Wherein, the processor 901 and the memory 902 can be coupled through an interface circuit or integrated together, which is not limited here.

[0157] The embodiment of the present application does not limit the specific connection medium between the above processor 901, memory 902 and communication interface 903. The embodiment of the present application is connected through a bus 904 between the processor 901, memory 902 and communication interface 903 in FIG. 9, and the bus is represented by a thick line in FIG. 9, and the connection mode between other components is only schematically illustrated and is not limited. The bus can be divided into address bus, data bus, control bus, etc. For convenience, only one thick line is used to represent the bus in FIG. 9, but it does not mean that there is only one bus or only one type of bus.

[0158] It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor which reads software codes stored in the memory to implement.

[0159] The processor can be, for example, a Central Processing Unit (CPU), a general-purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or the like. The general-purpose processor can be a microprocessor or the processor can be any conventional processor.

[0160] It should be understood that the memory mentioned in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM) or a flash memory. The volatile memory can be a Random Access Memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM) and Direct Rambus RAM (DR RAM).

[0161] It should be noted that when the processor is a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, the memory (storage module) can be integrated in the processor.

[0162] It should be noted that the memory described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0163] As another possible implementation form of the application, a computer readable storage medium is provided, storing instructions which, when executed by a computer, cause the computer to carry out the method according to the embodiment shown in Fig. 1.

[0164] Those skilled in the art will appreciate that embodiments of the application can be supplied as methods, systems, or computer program products. Accordingly, the application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the application can be embodied in the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage media, etc.) having computer usable program code embodied thereon.

[0165] The application is described herein with reference to the flowchart and / or block diagram illustrations of the methods, apparatus (systems), and computer program products according to the application. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks.

[0166] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks.

[0167] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks.

[0168] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method of sample generation, characterized by, The method comprises: obtaining a second sample based on a first sample in a training set and a first generator; each sample in the training set is an abnormal program with abnormal behavior collected in a network security detection scene; inputting the first sample and the second sample into a first discriminator respectively to obtain a first discrimination result and a second discrimination result; determining a first loss value based on the first discrimination result and the second discrimination result, training the first discriminator with the first loss value as a target to obtain a second discriminator; the discriminator is used to judge the probability of the input sample being an abnormal program; the size of the first loss value is used to indicate the difference between the first sample and the second sample; training the first generator based on the discrimination result output by the second discriminator to obtain a second generator, and then training the second discriminator and the second generator based on other samples in the training set in a cycle until a target generator is obtained when the training times reach a preset number or a preset termination condition is met; obtaining a target sample set based on the target generator and a plurality of preset abnormal programs; wherein the target sample in the target sample set is used to train an abnormal program identification model.

2. The method of claim 1, wherein, The method comprises: amending at least one data in the first sample to obtain the third sample; inputting the third sample into the first generator to obtain the second sample.

3. The method of claim 2, wherein, The method comprises: inputting the second sample into the second discriminator to obtain a third discrimination result; determining a second loss value based on the third discrimination result, and training the first generator to obtain the second generator with the second loss value as a target; the size of the second loss value is used to indicate the difference between the second sample and the abnormal program.

4. The method of claim 3, wherein, The method comprises: inputting the first sample into the first generator to obtain a fourth sample; inputting the fourth sample into the second discriminator to obtain a fourth discrimination result; inputting the third discrimination result and the fourth discrimination result into a preset first loss function respectively to obtain a first sub-loss value and a second sub-loss value; taking the sum of the first sub-loss value and the second sub-loss value as the second loss value.

5. The method of claim 3, wherein, The method comprises: inputting the second sample into a third generator to obtain a fifth sample; the third generator is used to restore the sample generated by the first generator; inputting the third discrimination result into a preset first loss function to obtain a first sub-loss value, and inputting the fifth sample and the third sample into a preset second loss function to obtain a third sub-loss value; the size of the third sub-loss value is used to indicate the difference between the fifth sample and the third sample; The second loss value is determined according to the first sub-loss value and the third sub-loss value.

6. The method of claim 1, wherein, The target sample set is obtained based on the target generator and a plurality of preset abnormal programs. The plurality of preset abnormal programs are input into the target generator to obtain a candidate sample set, the candidate sample set includes a plurality of candidate samples, the similarity between any two candidate samples in the candidate sample set is determined according to a vector corresponding to each candidate sample, and the vector corresponding to each candidate sample indicates the abnormal behavior of each candidate sample. The target sample set is selected from the candidate sample set based on the similarity between any two candidate samples, and the similarity between any two target samples in the target sample set is less than a threshold.

7. A sample generating apparatus, characterized by comprising: The device comprises: The acquisition module is configured to obtain a second sample based on a first sample in a training set and a first generator, each sample in the training set being an abnormal program with abnormal behavior collected in a network security detection scenario; The processing module is configured to input the first sample and the second sample into a first discriminator to obtain a first discrimination result and a second discrimination result, determine a first loss value based on the first discrimination result and the second discrimination result, train the first discriminator to obtain a second discriminator with the first loss value being minimized as a target, the discriminator being configured to determine a probability that an input sample is an abnormal program, the first loss value being configured to indicate a difference between the first sample and the second sample, train the first generator based on a discrimination result output by the second discriminator to obtain a second generator, and train the second discriminator and the second generator based on other samples in the training set in a loop until a target generator is obtained when a preset number of training times is reached or a preset termination condition is met, and obtain a target sample set based on the target generator and a plurality of preset abnormal programs, wherein a target sample in the target sample set is configured to train an abnormal program recognition model.

8. The apparatus of claim 7, wherein, The acquisition module is configured to: modify at least one piece of data in the first sample to obtain the third sample; input the third sample into the first generator to obtain the second sample.

9. An electronic device, comprising: comprise: at least one processor; and a memory and a communication interface connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the electronic device executes the method of any one of claims 1-6 through the communication interface.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, when the computer instructions run on the computer, make the computer execute the method of any one of claims 1-6. The computer readable storage medium stores computer instructions, when the computer instructions run on the computer, make the computer execute the method of any one of claims 1-6.

Images