CN112511521B - IP address black and gray list analysis method based on DDPG algorithm and server - Google Patents

IP address black and gray list analysis method based on DDPG algorithm and server Download PDF

Info

Publication number
CN112511521B
CN112511521B CN202011320381.3A CN202011320381A CN112511521B CN 112511521 B CN112511521 B CN 112511521B CN 202011320381 A CN202011320381 A CN 202011320381A CN 112511521 B CN112511521 B CN 112511521B
Authority
CN
China
Prior art keywords
gray list
black
address black
list analysis
address
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202011320381.3A
Other languages
Chinese (zh)
Other versions
CN112511521A (en
Inventor
王智明
徐雷
陶冶
于城
边林
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China United Network Communications Group Co Ltd
Original Assignee
China United Network Communications Group Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China United Network Communications Group Co Ltd filed Critical China United Network Communications Group Co Ltd
Priority to CN202011320381.3A priority Critical patent/CN112511521B/en
Publication of CN112511521A publication Critical patent/CN112511521A/en
Application granted granted Critical
Publication of CN112511521B publication Critical patent/CN112511521B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Biophysics (AREA)
  • Molecular Biology (AREA)
  • Biomedical Technology (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • Computational Linguistics (AREA)
  • Software Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The present disclosure provides a DDPG-based IP address black and gray list analysis method, a server, a terminal device, and a storage medium, wherein the method includes: receiving an IP address black and gray list analysis request of a user; analyzing the IP address black and gray list analysis request based on a DDPG algorithm to obtain an initial IP address black and gray list analysis scheme; analyzing the initial IP address black and gray list analysis scheme to obtain a final IP address black and gray list analysis scheme; acquiring user IP data from the IP data source of the user; and analyzing the user IP data based on the final IP address black and gray list analysis scheme to obtain an IP address black and gray list. The embodiment of the disclosure can at least solve the problems of high response delay, low accuracy, low coverage rate and the like in the identification process of the black and grey list of the IP address of the user at present.

Description

IP address black and gray list analysis method based on DDPG algorithm and server
Technical Field
The present disclosure relates to the field of communications technologies, and in particular, to an IP address black and gray list analysis method based on DDPG, an IP address black and gray list analysis server, a terminal device, and a computer-readable storage medium.
Background
With the rapid development of 5G (5th-Generation, fifth Generation communication technology) networks, the currently adopted IP address black and gray list identification method is gradually unable to adapt to the increasing demands for faster attack speed and greater destructiveness of IP networks, and the problems of high response delay, low accuracy, low coverage rate, and the like, which are generated by the method, are increasingly prominent.
Disclosure of Invention
The present disclosure provides an IP address black and gray list analysis method based on DDPG algorithm, an IP address black and gray list analysis server, a terminal device, and a computer-readable storage medium, to at least solve the above-mentioned problems.
According to an aspect of the embodiments of the present disclosure, a method for analyzing a black and grey list of an IP address based on a DDPG is provided, including:
receiving an IP address black and gray list analysis request of a user;
analyzing the IP address black and gray list analysis request based on a DDPG algorithm to obtain an initial IP address black and gray list analysis scheme;
analyzing the initial IP address black and gray list analysis scheme to obtain a final IP address black and gray list analysis scheme;
acquiring user IP data from an IP data source of the user; and (c) a second step of,
and analyzing the user IP data based on the final IP address black and gray list analysis scheme to obtain an IP address black and gray list.
In one embodiment, the method further comprises:
determining an optimization parameter of the IP address black and gray list analysis request;
analyzing the IP address black and gray list analysis request based on the DDPG algorithm to obtain an initial IP address black and gray list analysis scheme, wherein the scheme comprises the following steps:
analyzing the IP address black and gray list analysis request based on a DDPG algorithm aiming at the optimization parameters to obtain an initial IP address black and gray list analysis scheme;
analyzing the initial IP address black and gray list analysis scheme to obtain a final IP address black and gray list analysis scheme, wherein the final IP address black and gray list analysis scheme comprises the following steps:
and analyzing the initial IP address black and gray list analysis scheme according to the optimization parameters to obtain a final IP address black and gray list analysis scheme.
In one embodiment, the optimization parameters include coverage, accuracy, and response delay;
analyzing the IP address black and gray list analysis request aiming at the optimized parameters based on a DDPG algorithm to obtain an initial IP address black and gray list analysis scheme, and obtaining the IP address black and gray list analysis scheme according to the following formula:
Figure GDA0002909987590000021
in the formula (I), the compound is shown in the specification,
Figure GDA0002909987590000022
representing an initial IP address black and gray list analysis scheme, wherein k is iteration times; i. j and t are dimensions, and i is epsilon [1, m],j∈[1,n],t∈[1,q]M, n and q respectively represent the maximum value of the dimension;
Figure GDA0002909987590000023
is the gradient at the kth iteration;
Figure GDA0002909987590000024
the coverage rate at the k iteration is;
Figure GDA0002909987590000025
the accuracy at the kth iteration is obtained;
Figure GDA0002909987590000026
is the response delay rate at the kth iteration.
In an embodiment, analyzing the initial IP address black and gray list analysis scheme according to the optimization parameter to obtain a final IP address black and gray list analysis scheme includes:
setting an iteration initial parameter and a maximum iteration number;
performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters to obtain an intermediate IP address black and gray list analysis scheme with optimal matching degree;
judging whether the middle IP address black and gray list analysis scheme with the optimal matching degree meets a preset evaluation condition or not;
if the preset evaluation condition is met, selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme;
if the current iteration times are not larger than the maximum iteration times, judging whether the current iteration times are larger than or equal to the maximum iteration times;
if the number of iterations is not larger than the maximum number of iterations, performing deep unsupervised learning on the initial IP address black and gray list analysis scheme to obtain an initial IP address black and gray list analysis scheme with the number of iterations added by 1, and returning to the step of performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters;
and if the number of iterations is larger than the maximum iteration number, selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme.
In an embodiment, the initial IP address black and gray list analysis scheme is deeply analyzed according to the optimized parameter to obtain an intermediate IP address black and gray list analysis scheme with an optimal matching degree, and the intermediate IP address black and gray list analysis scheme is obtained according to the following formula:
Figure GDA0002909987590000031
in the formula, Min ZKRepresenting the intermediate IP address black and gray list analysis scheme with the optimal matching degree obtained in the k iteration, CGmaxRepresenting the historical highest accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage.
In an embodiment, whether the middle IP address black and gray list analysis scheme with the optimal matching degree meets a preset evaluation condition is determined according to the following formula:
Figure GDA0002909987590000032
in the formula (I), the compound is shown in the specification,
Figure GDA0002909987590000033
representing the probability of the accuracy product at the kth iteration,
Figure GDA0002909987590000034
representing the probability of the response delay rate product at the kth iteration,
Figure GDA0002909987590000035
representing the probability of coverage product at the kth iteration.
In an embodiment, deep unsupervised learning is performed on the initial IP address black and gray list analysis scheme to obtain an initial IP address black and gray list analysis scheme in which the iteration number is increased by 1, and the initial IP address black and gray list analysis scheme is obtained according to the following formula:
Figure GDA0002909987590000041
Figure GDA0002909987590000042
in the formula (I), the compound is shown in the specification,
Figure GDA0002909987590000043
an initial IP address black and gray list analysis scheme for representing the k +1 th iteration time comprises
Figure GDA0002909987590000044
The information vector of the three aspects is that,
Figure GDA0002909987590000045
indicating the accuracy at the k +1 th iteration,
Figure GDA0002909987590000046
represents the response delay rate at the k +1 th iteration,
Figure GDA0002909987590000047
indicating the coverage at the k +1 th iteration,
Figure GDA0002909987590000048
representing a depth unsupervised learning enhancement factor when the iteration times are the (k + 1) th time;
wherein the deep unsupervised learning enhancement factor
Figure GDA0002909987590000049
Obtained according to the following formula:
Figure GDA00029099875900000410
in the formula, CGmaxRepresenting the historical highest accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage.
According to another aspect of the embodiments of the present disclosure, there is provided an IP address black and gray list analysis server, including:
the receiving module is used for receiving an IP address black and gray list analysis request of a user;
the first analysis module is set to analyze the IP address black and gray list analysis request based on a DDPG algorithm to obtain an initial IP address black and gray list analysis scheme;
the second analysis module is configured to analyze the initial IP address black and gray list analysis scheme to obtain a final IP address black and gray list analysis scheme;
an acquisition module configured to acquire user IP data from an IP data source of the user; and the number of the first and second groups,
and the third analysis module is set to analyze the user IP data based on the final IP address black and gray list analysis scheme to obtain an IP address black and gray list.
According to still another aspect of the embodiments of the present disclosure, there is provided a terminal device, including a memory and a processor, where the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the IP address black and gray list analysis method based on the DDPG algorithm.
According to still another aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor executes the IP address black and gray list analysis method based on the DDPG algorithm.
The technical scheme provided by the embodiment of the disclosure can have the following beneficial effects:
the IP address black and gray list analysis method based on the DDPG provided by the embodiment of the disclosure receives an IP address black and gray list analysis request of a user; analyzing the IP address black and gray list analysis request based on a DDPG algorithm to obtain an initial IP address black and gray list analysis scheme; analyzing the initial IP address black and gray list analysis scheme to obtain a final IP address black and gray list analysis scheme; acquiring user IP data from an IP data source of the user; and analyzing the user IP data based on the final IP address black and gray list analysis scheme to obtain an IP address black and gray list. The embodiment of the disclosure can at least solve the problems of high response delay, low accuracy, low coverage rate and the like in the current identification process of the black and grey list of the IP address of the user.
Additional features and advantages of the disclosure will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the disclosure. The objectives and other advantages of the disclosure may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
The accompanying drawings are included to provide a further understanding of the disclosed embodiments and are incorporated in and constitute a part of this specification, illustrate embodiments of the disclosure and together with the example serve to explain the principles of the disclosure and not to limit the disclosure.
Fig. 1 is a schematic flowchart of a method for analyzing a black and grey list of an IP address based on DDPG according to an embodiment of the present disclosure;
FIG. 2 is a schematic view of a scene diagram of an IP address black and gray list identification scene;
FIG. 3 is a schematic diagram illustrating an initial IP address blacklist analysis scheme stored in a three-dimensional vector format in accordance with an embodiment of the present disclosure;
FIG. 4 is a flowchart illustrating step S102;
FIG. 5 is a schematic diagram of a convolutional neural network in accordance with an embodiment of the present disclosure;
fig. 6 is a schematic flowchart illustrating deep analysis performed on the IP address black and gray list analysis scheme according to the optimized parameter in the embodiment of the present disclosure;
fig. 7 is a schematic structural diagram of an IP address black and gray list analysis server according to an embodiment of the present disclosure;
fig. 8 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
Detailed Description
To make the objects, technical solutions and advantages of the embodiments of the present disclosure more apparent, specific embodiments of the present disclosure are described below in detail with reference to the accompanying drawings. It should be understood that the detailed description and specific examples, while indicating the present disclosure, are given by way of illustration and explanation only, not limitation.
It should be noted that the terms "first," "second," and the like in the description and claims of the present disclosure and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order; also, the embodiments and features of the embodiments in the present disclosure may be arbitrarily combined with each other without conflict.
In the following description, suffixes such as "module", "component", or "unit" used to denote elements are used only for the convenience of explanation of the present disclosure, and have no specific meaning in themselves. Thus, "module", "component" or "unit" may be used mixedly.
With the rapid development of 5G networks, the 5G networks refer to the fifth generation networks in the development of mobile communication networks, and compared with the previous four generation mobile networks, the 5G networks show more enhanced functions in practical application processes, and theoretically, the transmission speed can reach 10 GB/s, which is hundreds of times that of the 4G mobile networks. For a 5G network, the network shows more obvious advantages and more powerful functions in the practical application process, and meanwhile, the traditional identification mode of the black and grey list of the IP address gradually cannot adapt to the increasing demands of faster attack speed and higher destructive power of the IP network, and the problems of high response delay, low accuracy, low coverage rate and the like generated by the traditional identification mode of the black and grey list of the IP address are increasingly prominent.
Referring to fig. 1, fig. 1 is a schematic flowchart illustrating a method for analyzing a black and gray list of IP addresses based on DDPG according to an embodiment of the present disclosure, where the method includes steps S101 to S105.
In step S101, a user' S IP address black and gray list analysis request is received.
Referring to fig. 2, fig. 2 is a diagram of a scenario of identifying a black and grey list of IP addresses based on a markov decision process (and accumulated return), which is mainly divided into three layers: 1) a resource layer comprising: the IP data sources of all user sides (internal users, external users and public users) mainly realize the acquisition and feedback of IP data. 2) An analysis layer comprising: and the IP address black and gray list analysis server realizes the analysis of the IP address black and gray list. 3) An open layer comprising: and the internal user, the external user, the public user and the like realize the access and feedback of the analysis request of the black and grey list of the IP address of the user.
Specifically, an internal user, an external user and a public user in an open layer firstly send a user IP address black and gray list analysis request to an IP address black and gray list analysis server in an analysis layer; an IP address black and gray list analysis server in the analysis layer provides an IP address black and gray list analysis service; an IP address black and gray list in an analysis layer generates an IP address black and gray list analysis scheme based on an IP address black and gray list analysis request, then all parties of IP data are called, and all parties of IP data sources return the IP data to an IP address black and gray list analysis server; and finally, the IP address black and gray list analysis server analyzes the IP address according to the generated analysis scheme and feeds back the analysis result to the internal user, the external user and the public user in the open layer.
In step S102, the IP address black and gray list analysis request is analyzed based on the DDPG algorithm, so as to obtain an initial IP address black and gray list analysis scheme.
The traditional DDPG adopts a target-net parameter update called 'hard' mode, i.e. Network parameters in eval-net are assigned at certain step number, while in DDPG, a target-net parameter update in 'soft' mode is adopted, i.e. parameters in the target-net Network are updated a little at each step, and the parameter update mode is proved by experiments to greatly improve the learning stability.
In this embodiment, the DDPG algorithm is used to analyze the IP address black and gray list analysis request, and an initial IP address black and gray list analysis scheme is generated by performing reinforcement learning based on the DDPG algorithm through the analysis request sent by the user mainly for feature analysis based on second variation times and online time, that is, the number of times of IP variation of online time on the user account, so as to reduce response delay, improve accuracy, and enhance coverage.
Specifically, the method further comprises the following steps:
determining an optimization parameter of the IP address black and gray list analysis request;
the step S102 specifically includes: analyzing the IP address black and gray list analysis request based on a DDPG algorithm aiming at the optimization parameters to obtain an initial IP address black and gray list analysis scheme;
in one embodiment, the optimization parameters include coverage, accuracy, and response delay;
analyzing the IP address black and gray list analysis request aiming at the optimization parameters based on a DDPG algorithm to obtain an initial IP address black and gray list analysis scheme, and obtaining the IP address black and gray list analysis scheme according to the following formula:
Figure GDA0002909987590000081
in the formula (I), the compound is shown in the specification,
Figure GDA0002909987590000082
representing an initial IP address black and gray list analysis scheme, wherein k is iteration times; i. j and t are dimensions, and i is epsilon [1, m],j∈[1,n],t∈[1,q]M, n and q respectively represent the maximum value of the dimensionality;
Figure GDA0002909987590000083
the gradient at the k-th iteration is indicated,
Figure GDA0002909987590000084
the coverage rate at the k iteration is;
Figure GDA0002909987590000085
the accuracy at the kth iteration is obtained;
Figure GDA0002909987590000086
is the response delay rate at the kth iteration.
The present embodiment employs a sparse matrix to store an initial IP address black and gray list analysis scheme in the form of a three-dimensional vector,
Figure GDA0002909987590000087
where i, j, and t are dimensions. As shown in figure 3 of the drawings,
Figure GDA0002909987590000088
and storing each optimization parameter in the corresponding dimension position of i, j, t (namely any value on m, n and q coordinates). In some embodiments, optimization of coverage, accuracy, and response delay rate for an IP address black and gray list analysis scheme is achieved in conjunction with a convolutional neural network.
For convenience of understanding, the strategy ideas of the multi-layer neurons, the data processing, the DDPG and the like in each iteration are that in a 1,2, L h multidimensional space, a plurality of depth analysis (feature analysis based on second variation times and online time) schemes migrate to the direction determined by the optimization task priority scheme according to strategy modes of the multi-layer neurons, the data processing, the DDPG and the like. As shown in fig. 4, IP data is input by a request, and after multi-layer neuron, data processing, and DDPG analysis, a corresponding analysis result is output, and as shown in fig. 5, the multi-layer neuron network includes: coverage rate W (total analyzed amount of black and gray accounts/total actual amount of black and gray accounts), response delay rate E (amount of time that black and gray accounts are ineffectively occupied per unit time), and accuracy rate C (total analyzed amount of actual black and gray accounts/total analyzed amount of black and gray accounts). The output quantity comprises: and (4) pre-recommendation information of the IP address black and gray list initial analysis scheme.
In step S103, the initial IP address black and gray list analysis scheme is analyzed to obtain a final IP address black and gray list analysis scheme.
Specifically, the initial IP address black and gray list analysis scheme is analyzed according to the optimization parameters, and a final IP address black and gray list analysis scheme is obtained.
In step S104, user IP data is obtained from the IP data source of the user.
In step S105, the user IP data is analyzed based on the final IP address black and gray list analysis scheme, so as to obtain an IP address black and gray list.
Further, analyzing the initial IP address black and gray list analysis scheme according to the optimized parameters to obtain a final IP address black and gray list analysis scheme, as shown in fig. 6, including the following steps:
a. setting an iteration initial parameter and a maximum iteration number;
b. performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters to obtain an intermediate IP address black and gray list analysis scheme with optimal matching degree;
c. judging whether the middle IP address black and gray list analysis scheme with the optimal matching degree meets a preset evaluation condition, if so, executing the step d, and if not, executing the step e;
d. selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme;
e. and d, judging whether the current iteration times are not more than the maximum iteration times, if not, executing f, otherwise, returning to the step d to select the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme.
f. And performing deep unsupervised learning on the initial IP address black and gray list analysis scheme to obtain an initial IP address black and gray list analysis scheme with the iteration times added by 1, and returning to the step of performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters.
It should be noted that, in the present embodiment, deep analysis is performed on the IP address black and gray list analysis scheme in an iterative loop manner, where a maximum iteration parameter may be set to 50, and in order to avoid infinite iteration optimization, when the number of iterations reaches 50, the scheme is defaulted to meet the evaluation condition.
In an embodiment, the initial IP address black and gray list analysis scheme is deeply analyzed according to the optimized parameter to obtain an intermediate IP address black and gray list analysis scheme with an optimal matching degree, and the intermediate IP address black and gray list analysis scheme is obtained according to the following formula:
Figure GDA0002909987590000101
in the formula, Min ZKRepresenting the intermediate IP address black and gray list analysis scheme with the optimal matching degree obtained in the k iteration, CGmaxRepresenting the historical maximum accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage.
Specifically, the initial IP address black and gray list analysis scheme is subjected to deep analysis, and a scheme of historical highest accuracy, historical lowest response delay rate and historical maximum coverage rate is selected as a middle IP address black and gray list analysis scheme with optimal matching degree in the k iteration according to the formula.
In an embodiment, whether the middle IP address black and gray list analysis scheme with the optimal matching degree meets a preset evaluation condition is determined according to the following formula:
Figure GDA0002909987590000102
in the formula (I), the compound is shown in the specification,
Figure GDA0002909987590000103
representing the probability of the accuracy product at the kth iteration,
Figure GDA0002909987590000104
representing the probability of the response delay rate product at the kth iteration,
Figure GDA0002909987590000105
representing the coverage product probability at the kth iteration.
In an embodiment, the initial IP address black and gray list analysis scheme is subjected to deep unsupervised learning to obtain an initial IP address black and gray list analysis scheme obtained by adding 1 to the iteration number, and is obtained according to the following formula:
Figure GDA0002909987590000111
Figure GDA0002909987590000112
in the formula (I), the compound is shown in the specification,
Figure GDA0002909987590000113
an initial IP address black and gray list analysis scheme for representing the k +1 th iteration time comprises
Figure GDA0002909987590000114
The information vector of the three aspects is that,
Figure GDA0002909987590000115
indicating the accuracy at the k +1 th iteration,
Figure GDA0002909987590000116
represents the response delay rate at the k +1 th iteration,
Figure GDA0002909987590000117
indicating the number of iterations asThe coverage rate is measured when the number of the k +1 times,
Figure GDA0002909987590000118
representing a depth unsupervised learning enhancement factor when the iteration times are (k + 1);
wherein the deep unsupervised learning enhancement factor
Figure GDA0002909987590000119
Obtained according to the following formula:
Figure GDA00029099875900001110
in the formula, CGmaxRepresenting the historical highest accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage.
Based on the same technical concept, an embodiment of the present disclosure correspondingly provides an IP address black and gray list analysis server, as shown in fig. 7, where the server includes:
a receiving module 71, configured to receive an IP address black and grey list analysis request of a user;
a first analysis module 72, configured to analyze the IP address black and gray list analysis request based on a DDPG algorithm, so as to obtain an initial IP address black and gray list analysis scheme;
a second analysis module 73 configured to analyze the initial IP address black and gray list analysis scheme to obtain a final IP address black and gray list analysis scheme;
an obtaining module 74 configured to obtain user IP data from an IP data source of the user; and the number of the first and second groups,
a third analysis module 75, configured to analyze the user IP data based on the final IP address black and gray list analysis scheme, so as to obtain an IP address black and gray list.
Based on the same technical concept, the embodiment of the present disclosure correspondingly provides a terminal device, as shown in fig. 8, the terminal device includes a memory 81 and a processor 82, a computer program is stored in the memory 81, and when the processor 82 runs the computer program stored in the memory 81, the processor 82 executes the IP address black and gray list analysis method based on the DDPG algorithm.
According to still another aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor executes the IP address black and gray list analysis method based on the DDPG algorithm.
It will be understood by those of ordinary skill in the art that all or some of the steps of the methods, systems, functional modules/units in the devices disclosed above may be implemented as software, firmware, hardware, or suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). The term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data, as is well known to those skilled in the art. Computer storage media includes, but is not limited to, RAM, ROM, EEQROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the computer. In addition, communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media as is well known to those skilled in the art.
Finally, it should be noted that: the above embodiments are only used for illustrating the technical solutions of the present disclosure, and not for limiting the same; although the present disclosure has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art will understand that: the technical solutions described in the foregoing embodiments may still be modified, or some or all of the technical features may be equivalently replaced; such modifications or substitutions do not depart from the scope of the embodiments of the present disclosure by the essence of the corresponding technical solutions.

Claims (8)

1. A method for analyzing an IP address black and gray list based on a deep deterministic policy gradient DDPG is characterized by comprising the following steps:
receiving an IP address black and gray list analysis request of a user;
determining optimization parameters of the IP address black and gray list analysis request, wherein the optimization parameters comprise coverage rate, accuracy rate and response delay rate;
analyzing the IP address black and gray list analysis request based on a DDPG algorithm aiming at the optimization parameters to obtain an initial IP address black and gray list analysis scheme;
analyzing the initial IP address black and gray list analysis scheme aiming at the optimization parameters to obtain a final IP address black and gray list analysis scheme;
acquiring user IP data from an IP data source of the user; and (c) a second step of,
analyzing the user IP data based on the final IP address black and gray list analysis scheme to obtain an IP address black and gray list;
the initial IP address black and gray list analysis scheme is obtained according to the following formula:
Figure FDA0003666096910000011
in the formula，
Figure FDA0003666096910000012
Representing an initial IP address black and grey list analysis scheme, wherein k is iteration times; i. j and t are dimensions, and i is epsilon [1, m],j∈[1,n],t∈[1,q]M, n and q respectively represent the maximum value of the dimensionality;
Figure FDA0003666096910000013
is the gradient at the kth iteration;
Figure FDA0003666096910000014
the coverage rate is the coverage rate of the kth iteration, and the coverage rate is the total amount of the analyzed black and gray accounts/the total amount of the actual black and gray accounts;
Figure FDA0003666096910000015
the accuracy rate is the accuracy rate of the kth iteration, and the accuracy rate is the number of the analyzed actual black and gray accounts/the total number of the analyzed black and gray accounts;
Figure FDA0003666096910000016
the response delay rate is the response delay rate of the kth iteration, and the response delay rate is the amount of invalid occupied time/total amount of unit time in the analysis of the black and gray accounts in unit time;
analyzing the initial IP address black and gray list analysis scheme aiming at the optimization parameters to obtain a final IP address black and gray list analysis scheme, wherein the method comprises the following steps:
setting an iteration initial parameter and a maximum iteration number;
performing deep analysis on the initial IP address black and gray list analysis scheme according to the optimized parameters to obtain an intermediate IP address black and gray list analysis scheme with optimal matching degree, and obtaining the intermediate IP address black and gray list analysis scheme according to the following formula:
Figure FDA0003666096910000021
in the formula, Min ZKDenotes the kthObtaining an intermediate IP address black and gray list analysis scheme with optimal matching degree during secondary iteration, CGmaxRepresenting the historical highest accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage;
judging whether the middle IP address black and gray list analysis scheme with the optimal matching degree meets a preset evaluation condition or not;
if the preset evaluation condition is met, selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme;
if the current iteration times are not larger than the maximum iteration times, judging whether the current iteration times are larger than or equal to the maximum iteration times; if the number of iterations is not larger than the maximum number of iterations, performing deep unsupervised learning on the initial IP address black and gray list analysis scheme to obtain an initial IP address black and gray list analysis scheme with the number of iterations added by 1, and returning to the step of performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters; and if the maximum iteration number is larger than the maximum iteration number, selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme.
2. The method according to claim 1, wherein the determining whether the middle IP address black and gray list analysis scheme with the optimal matching degree satisfies a preset evaluation condition is performed according to the following formula:
Figure FDA0003666096910000022
in the formula (I), the compound is shown in the specification,
Figure FDA0003666096910000023
representing the probability of the accuracy product at the kth iteration,
Figure FDA0003666096910000024
representing the response delay rate at the k-th iterationThe probability of the product is then calculated,
Figure FDA0003666096910000025
representing the coverage product probability at the kth iteration.
3. The method of claim 1, wherein the initial IP address black and gray list analysis scheme is subjected to deep unsupervised learning to obtain an initial IP address black and gray list analysis scheme with 1 added to the number of iterations, and is obtained according to the following formula:
Figure FDA0003666096910000031
Figure FDA0003666096910000032
in the formula (I), the compound is shown in the specification,
Figure FDA0003666096910000033
an initial IP address black and gray list analysis scheme for representing the k +1 th iteration time comprises
Figure FDA0003666096910000034
The information vector of the three aspects is that,
Figure FDA0003666096910000035
indicating the accuracy at the k +1 th iteration,
Figure FDA0003666096910000036
represents the response delay rate at the k +1 th iteration,
Figure FDA0003666096910000037
indicating the coverage at the k +1 th iteration,
Figure FDA0003666096910000038
representing a depth unsupervised learning enhancement factor when the iteration times are (k + 1);
wherein the deep unsupervised learning enhancement factor
Figure FDA0003666096910000039
Obtained according to the following formula:
Figure FDA00036660969100000310
in the formula, CGmaxRepresenting the historical maximum accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage.
4. An IP address black and gray list analysis server, comprising:
the receiving module is used for receiving an IP address black and gray list analysis request of a user;
a determining module configured to determine optimization parameters of the IP address black and grey list analysis request, where the optimization parameters include a coverage rate, an accuracy rate, and a response delay rate;
the first analysis module is configured to analyze the IP address black and gray list analysis request based on a DDPG algorithm aiming at the optimization parameters to obtain an initial IP address black and gray list analysis scheme;
the second analysis module is configured to analyze the initial IP address black and gray list analysis scheme according to the optimization parameters to obtain a final IP address black and gray list analysis scheme;
an acquisition module configured to acquire user IP data from the user's IP data source; and (c) a second step of,
a third analysis module configured to analyze the user IP data based on the final IP address black and gray list analysis scheme to obtain an IP address black and gray list;
the initial IP address black and gray list analysis scheme is obtained according to the following formula:
Figure FDA0003666096910000041
in the formula (I), the compound is shown in the specification,
Figure FDA0003666096910000042
representing an initial IP address black and grey list analysis scheme, wherein k is iteration times; i. j and t are dimensions, and i is [1, m ]],j∈[1,n],t∈[1,q]M, n and q respectively represent the maximum value of the dimensionality;
Figure FDA0003666096910000043
is the gradient at the kth iteration;
Figure FDA0003666096910000044
the coverage rate is the coverage rate of the kth iteration, and the coverage rate is the total amount of the analyzed black and gray accounts/the total amount of the actual black and gray accounts;
Figure FDA0003666096910000045
the accuracy rate is the accuracy rate of the kth iteration, and the accuracy rate is the number of the analyzed actual black and gray accounts/the total number of the analyzed black and gray accounts;
Figure FDA0003666096910000046
the response delay rate is the response delay rate of the kth iteration, and the response delay rate is the invalid occupied time amount/unit time total amount of the analysis of the black and gray accounts in unit time;
wherein, the second analysis module is specifically configured to:
setting an iteration initial parameter and a maximum iteration number;
performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters to obtain an intermediate IP address black and gray list analysis scheme with the optimal matching degree, and obtaining the intermediate IP address black and gray list analysis scheme according to the following formula:
Figure FDA0003666096910000047
in the formula, Min ZKA middle IP address black and gray list analysis scheme with the optimal matching degree is obtained in the kth iteration, CGmaxRepresenting the historical maximum accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage;
judging whether the middle IP address black and gray list analysis scheme with the optimal matching degree meets a preset evaluation condition or not;
if the preset evaluation condition is met, selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme;
if the current iteration times are not larger than the maximum iteration times, judging whether the current iteration times are larger than or equal to the maximum iteration times; if the number of iterations is not larger than the maximum number of iterations, performing deep unsupervised learning on the initial IP address black and gray list analysis scheme to obtain an initial IP address black and gray list analysis scheme with the number of iterations added by 1, and returning to execute the operation of performing deep analysis on the initial IP address black and gray list analysis scheme aiming at the optimization parameters; and if the number of iterations is larger than the maximum iteration number, selecting the intermediate IP address black and gray list analysis scheme with the optimal matching degree as a final IP address black and gray list analysis scheme.
5. The IP address black and gray list analysis server according to claim 4, wherein the second analysis module determines whether the middle IP address black and gray list analysis scheme with the optimal matching degree satisfies a preset evaluation condition, and obtains the result according to the following formula:
Figure FDA0003666096910000051
in the formula (I), the compound is shown in the specification,
Figure FDA0003666096910000052
representing the k-th iterationThe probability of the product of the accuracy and the probability,
Figure FDA0003666096910000053
representing the probability of the response delay rate product at the kth iteration,
Figure FDA0003666096910000054
representing the coverage product probability at the kth iteration.
6. The IP address black and gray list analysis server of claim 4, wherein the second analysis module performs deep unsupervised learning on the initial IP address black and gray list analysis scheme to obtain the initial IP address black and gray list analysis scheme after the iteration number is added by 1, and the initial IP address black and gray list analysis scheme is obtained according to the following formula:
Figure FDA0003666096910000061
Figure FDA0003666096910000062
in the formula (I), the compound is shown in the specification,
Figure FDA0003666096910000063
an initial IP address black and gray list analysis scheme for representing the k +1 th iteration time comprises
Figure FDA0003666096910000064
The information vector of the three aspects is that,
Figure FDA0003666096910000065
indicating the accuracy at the k +1 th iteration,
Figure FDA0003666096910000066
represents the response delay rate at the k +1 th iteration,
Figure FDA0003666096910000067
indicating the coverage at the k +1 th iteration,
Figure FDA0003666096910000068
representing a depth unsupervised learning enhancement factor when the iteration times are (k + 1);
wherein the deep unsupervised learning enhancement factor
Figure FDA0003666096910000069
Obtained according to the following formula:
Figure FDA00036660969100000610
in the formula, CGmaxRepresenting the historical maximum accuracy, EGminRepresents the historical lowest response delay rate, WGmaxRepresenting historical maximum coverage.
7. A terminal device comprising a memory and a processor, wherein the memory stores therein a computer program, and when the processor runs the computer program stored in the memory, the processor performs the IP address black and gray list analyzing method based on the DDPG algorithm according to any one of claims 1 to 3.
8. A computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the processor performs the IP address black and gray list analysis method based on DDPG algorithm according to any one of claims 1 to 3.
CN202011320381.3A 2020-11-23 2020-11-23 IP address black and gray list analysis method based on DDPG algorithm and server Active CN112511521B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011320381.3A CN112511521B (en) 2020-11-23 2020-11-23 IP address black and gray list analysis method based on DDPG algorithm and server

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011320381.3A CN112511521B (en) 2020-11-23 2020-11-23 IP address black and gray list analysis method based on DDPG algorithm and server

Publications (2)

Publication Number Publication Date
CN112511521A CN112511521A (en) 2021-03-16
CN112511521B true CN112511521B (en) 2022-07-22

Family

ID=74959484

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011320381.3A Active CN112511521B (en) 2020-11-23 2020-11-23 IP address black and gray list analysis method based on DDPG algorithm and server

Country Status (1)

Country Link
CN (1) CN112511521B (en)

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9148432B2 (en) * 2010-10-12 2015-09-29 Microsoft Technology Licensing, Llc Range weighted internet protocol address blacklist
US8516595B2 (en) * 2010-12-28 2013-08-20 Caixa d'Estalvis I Pensions de Barcelona “La Caixa” Method and system for estimating the reliability of blacklists of botnet-infected computers
CN105721406A (en) * 2014-12-05 2016-06-29 中国移动通信集团广东有限公司 Method and device for obtaining IP black list
CN107483480B (en) * 2017-09-11 2020-05-12 杭州迪普科技股份有限公司 Address processing method and device
US11277380B2 (en) * 2018-12-17 2022-03-15 T-Mobile Usa, Inc. Adaptive malicious network traffic response

Also Published As

Publication number Publication date
CN112511521A (en) 2021-03-16

Similar Documents

Publication Publication Date Title
CN109978142B (en) Neural network model compression method and device
CN109948029B (en) Neural network self-adaptive depth Hash image searching method
CN112181666A (en) Method, system, equipment and readable storage medium for equipment evaluation and federal learning importance aggregation based on edge intelligence
CN109255054B (en) Relation weight-based community discovery method in enterprise map
CN107798379B (en) Method for improving quantum particle swarm optimization algorithm and application based on improved algorithm
CN110069341B (en) Method for scheduling tasks with dependency relationship configured according to needs by combining functions in edge computing
CN111163461B (en) Terminal data tamper-proof method and system, tamper-proof server and storage medium
Lei et al. Learning-based resource allocation: Efficient content delivery enabled by convolutional neural network
CN112598062A (en) Image identification method and device
CN114819143A (en) Model compression method suitable for communication network field maintenance
CN112733863A (en) Image feature extraction method, device, equipment and storage medium
CN111581442A (en) Method and device for realizing graph embedding, computer storage medium and terminal
CN115359298A (en) Sparse neural network-based federal meta-learning image classification method
CN113962163A (en) Optimization method, device and equipment for realizing efficient design of passive microwave device
CN112511521B (en) IP address black and gray list analysis method based on DDPG algorithm and server
CN116415647A (en) Method, device, equipment and storage medium for searching neural network architecture
CN111770152B (en) Edge data management method, medium, edge server and system
CN112541556A (en) Model construction optimization method, device, medium, and computer program product
CN117241295A (en) Wireless communication network performance optimization method, device and storage medium
CN112491863B (en) IP address black and gray list analysis method, server, terminal and storage medium
CN112437460B (en) IP address black gray list analysis method, server, terminal and storage medium
CN115412401B (en) Method and device for training virtual network embedding model and virtual network embedding
CN116149855A (en) Method and system for optimizing performance resource cost under micro-service architecture
CN114449536B (en) 5G ultra-dense network multi-user access selection method based on deep reinforcement learning
CN115577797A (en) Local noise perception-based federated learning optimization method and system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant