CN117763492A - Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation - Google Patents
Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation Download PDFInfo
- Publication number
- CN117763492A CN117763492A CN202311653994.2A CN202311653994A CN117763492A CN 117763492 A CN117763492 A CN 117763492A CN 202311653994 A CN202311653994 A CN 202311653994A CN 117763492 A CN117763492 A CN 117763492A
- Authority
- CN
- China
- Prior art keywords
- user
- preference
- network security
- vector
- time
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 42
- 239000013598 vector Substances 0.000 claims abstract description 106
- 239000011159 matrix material Substances 0.000 claims abstract description 92
- 238000006243 chemical reaction Methods 0.000 claims abstract description 28
- 230000007774 longterm Effects 0.000 claims abstract description 24
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 12
- 230000006399 behavior Effects 0.000 claims description 56
- 230000009466 transformation Effects 0.000 claims description 21
- 230000009191 jumping Effects 0.000 claims description 12
- 238000012546 transfer Methods 0.000 claims description 9
- 125000004122 cyclic group Chemical group 0.000 claims description 8
- 230000006870 function Effects 0.000 claims description 8
- 238000004364 calculation method Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 6
- 230000004913 activation Effects 0.000 claims description 5
- 230000003993 interaction Effects 0.000 claims description 5
- 238000007781 pre-processing Methods 0.000 claims description 4
- 238000012935 Averaging Methods 0.000 claims description 3
- 238000013528 artificial neural network Methods 0.000 claims description 3
- 238000004140 cleaning Methods 0.000 claims description 3
- 230000004927 fusion Effects 0.000 claims description 3
- 238000013507 mapping Methods 0.000 claims description 3
- 238000010606 normalization Methods 0.000 claims description 3
- 238000000844 transformation Methods 0.000 claims description 3
- 230000007246 mechanism Effects 0.000 abstract description 4
- 230000008859 change Effects 0.000 description 3
- 230000000694 effects Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000002155 anti-virotic effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000003062 neural network model Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 238000010187 selection method Methods 0.000 description 1
Landscapes
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a network security tool intelligent recommendation method and device based on time sequence space characteristics and preference fluctuation, wherein a historical behavior sequence of a user is constructed by using data of the network security tool for the collected user, long-term preference of the user using the network security tool is captured by an improved space-time GRU algorithm, the improved space-time GRU algorithm discretizes continuous time factors, and a specific time conversion matrix and a specific distance conversion matrix are introduced; short-term preferences of the user using the network security tool are then captured through a multi-headed attention mechanism; then calculating a preference fluctuation value; finally, the learned long-term and short-term preference characteristics are combined with the user characteristic vector and the preference fluctuation vector to predict the next recommended position. Compared with the prior art, the method and the device have the advantages that the time sequence space characteristics and the user preference fluctuation are utilized to better understand the use habit of the network security tool of the user, so that the network security tool suitable for the user is recommended more accurately, and the network security is improved.
Description
Technical Field
The invention belongs to the technical field of network security and recommendation, and particularly relates to an intelligent network security tool recommendation method and device based on time sequence spatial characteristics and preference fluctuation.
Background
In the digital age today, network security is one of the continuing challenges facing organizations and individuals. As cyber attacks and threats continue to evolve and increase, it becomes critical to select an appropriate cyber-security tool. Traditional network security tool selection methods typically rely on the advice of a professional security officer or select tools based on static rules and specific network contexts. These approaches may not adequately take into account the actual needs and preferences of the user and organization. Therefore, it is necessary to recommend suitable network security tools based on the user's historical interaction sequence.
In the field of network security, the application of recommended techniques is also relatively few, especially for the selection of network security tools. Current cyber-security tool selections are generally limited to static rule-based and professional advice, but less consideration is given to the user's historical interaction information, which does not allow for a more comprehensive understanding of the user's preferences and needs, providing more personalized, real-time cyber-security tool advice. Moreover, the prior sequence recommendation technology has insufficient utilization of space-time information, incomplete interactivity of the characteristics of the mined user items, unsatisfactory effect of processing long sequence data, insufficient individuation of the generated next recommendation, and quality and accuracy of the recommendation to be improved.
Aiming at the above situation, an intelligent recommendation method for network security tools based on time sequence spatial characteristics and preference fluctuation is provided. By adding the time conversion matrix and the distance conversion matrix on the basis of the traditional GRU network, the time conversion matrix can capture the influence of the nearest elements in the history, and can better understand and predict the change of the user behavior in different time periods; the distance conversion matrix calculates Euclidean distance between two geographic positions of the user under the coordinate system, measures the moving distance of the user at different places, and can help the model consider the behavior change of the user from the space-time angle. By considering time and space factors, the long-term behavior characteristics of the user can be more accurately captured; capturing recent characteristics of the user as short-term preference through an attention mechanism; the user characteristics, long-term and short-term preferences and the preference fluctuation vector are fused, the problem that the characteristics represent singleness is avoided, the preferences and the demands of the user can be more comprehensively understood, the complete user preference characteristics are obtained, and therefore personalized and high-quality recommendation is carried out.
Disclosure of Invention
The invention aims to: aiming at the problems that the prior sequence recommendation system pointed out in the background technology is insufficient in utilization of time and space information, the interactivity of the characteristics of the mined user items is not complete, the effect of processing long-sequence data is not ideal, the quality and accuracy of recommendation are required to be improved and the like, the intelligent recommendation method and device for the network security tool based on time sequence space characteristics and preference fluctuation are disclosed, continuous time factors are discretized through an improved GRU algorithm, a specific time conversion matrix and a specific distance conversion matrix are introduced, and the output vectors are fused with the richer characteristics of preferences, positions and time, so that the long-term behavior characteristics of the user are captured more accurately.
The technical scheme is as follows: the invention provides a network security tool intelligent recommendation method based on time sequence space characteristics and preference fluctuation, which comprises the following steps:
step 1: cleaning and preprocessing collected data of a user using a network security tool, and constructing a historical behavior sequence of the user, wherein the historical behavior sequence comprises a user embedding matrix and a user behavior sequence embedding matrix, and the user embedding matrix and the user behavior sequence embedding matrix respectively comprise user characteristic vectors and user behavior sequence embedding vectors;
step 2: taking a user behavior sequence embedding matrix as input, and learning the long-term preference of a user for using a network security tool through an improved space-time GRU algorithm; the improved space-time GRU algorithm discretizes the continuous time factor and introduces a specific time conversion matrix and a specific distance conversion matrix;
step 3: the method comprises the steps that a user behavior sequence embedding matrix is used as input, recent network security tool preference using by a user is learned through a multi-head attention machine, and short-term preference of the user is represented;
step 4: computing user's usage network security tool preference fluctuation value F u ；
Step 5: and fusing the long-term preference, the short-term preference, the user characteristic vector and the preference fluctuation vector of the user to obtain the comprehensive characteristic expression of the user using the network security tool behavior and recommending the comprehensive characteristic expression.
Further, the specific method of the step 1 is as follows:
step 1.1: define user set u= { U 1 ,u 2 ,...,u a ,...u len(U) }，u a Is the a-th information data to be cleaned in U, wherein len (U) is the data quantity in U, and the variable a E [1, len (U)]；
Step 1.2: define network security tool set i= { I 1 ,i 2 ,...,i b ,...i len(I) }，i b Is the b information data to be cleaned in I, wherein len (I) is the data quantity in I, and the variable b E [1, len (I)]；
Step 1.3: performing deduplication and nulling operations on the data in the dataset U, I;
step 1.4: resulting in a cleaned dataset u1= { U 1 ,u 2 ,...,u a ,...u len(U) }，u a Is the a-th information data in U1, wherein len (U) is the data quantity in U, and the variable a E [1, len (U)]And dataset i1= { I 1 ,i 2 ,...,i b ,...i len(I) }，i b Is the b information data in I1, where len (I1) is the number of data in I1, variable b.epsilon.1, len (I1)]；
Step 1.5: defining a historical behavior sequence of a user asWherein->A network security tool representing previous interactions of the user, < +.>The subscript i of (1) indicates the order in which the network security tool appears in the sequence;
step 1.6: for the user set U1, a user embedding matrix E is obtained by a method of embedding high-dimensional sparse single thermal codes into low-dimensional dense feature vectors u ，e u Is a user embedding matrix E u Representing a user feature vector;
step 1.7: historical behavior sequence for a userThe method for embedding the high-dimensional sparse single thermal code into the low-dimensional dense feature vector is adopted to obtain a user behavior sequence embedding matrix E x ∈R n×k Where n x k represents the dimension of the matrix, e x Is a vector in the user behavior sequence embedding matrix, and represents the user behavior sequence embedding vector.
Further, the specific method of the step 2 is as follows:
step 2.1: input user behavior sequence embedding matrix E x ∈R n×k ；
Step 2.2: defining a cyclic variable i, wherein the initial value of i is 1;
step 2.3: if i.ltoreq.len (X) u ) Step 2.4 is skipped, otherwise step 2.13 is skipped;
step 2.4: acquiring a user behavior sequence embedding matrix E x ∈R n×k Line i vector e in (a) x ；
Step 2.5: embedding vector e according to user behavior sequence x ObtainingThe vector of the access position of the user u at the time t is expressed, and the hidden state vector of the user at the previous time t-1 is defined as h t-1 ；
Step 2.6: defining a particular time transformation matrixFor representing two points in time t and t i Time interval t-t between i Wherein t is i Representing a historical time point;
step 2.7: defining a particular distance conversion matrixEuclidean distance between two geographic coordinates, and the calculation formula is +.>Wherein (1)>And->Coordinates representing the position visited by user u at time t,/->And->Indicating the user u history time t i Coordinates of the accessed location;
step 2.8: computing input gateWherein W is i1 、W i2 Is a transformation matrix, W i3 、W i4 Is->And->Transfer matrix of b) i Is the bias vector, σ is the activation function, h t-1 Is the hidden state vector of the GRU at the previous moment;
step 2.9: door for calculating forgetfulnessWherein W is f1 、W f2 Is a transformation matrix, W f3 、W f4 Is->And->Transfer matrix of b) f Is a bias vector;
step 2.10: according to a time conversion matrixAnd distance conversion matrix>Calculating a new GRU candidate hidden state vector +.>Wherein h is t-1 Hidden state vector, W, representing GRU at previous time c1 、W c4 Is a transformation matrix and W c2 、W c3 Is->And->Transfer matrix of b) c Is a bias vector;
step 2.11: according to input gate i t And candidate hidden state vectorsUpdating hidden state vectors
Step 2.12: increasing the value of the circulation variable i, and jumping to the step 2.4;
step 2.13: ending the cycle, obtaining the output of the final GRU (GRU) through the tanh nonlinear activation function, namely the long-term preference g of the user t ＝tanh(C t )。
Further, the specific method of the step 3 is as follows:
step 3.1: input user behavior sequence embedding matrix E x ∈R n×k ；
Step 3.2: cycle variable i 2 And i 2 Giving an initial value of 1;
step 3.3: if i 2 ≤len(X u ) Jumping to step 3.4, otherwise jumping to step 3.10;
step 3.4: obtaining the obtainedUser behavior sequence embedding matrix E x ∈R n×k I of (a) 2 Line vector e x ；
Step 3.5: in head space h, user behavior is embedded into vector e by three different linear transformations x Mapping to query vectorsKey vector->Sum vector->The calculation formula is as follows: /> Wherein the method comprises the steps ofRepresenting a trainable parameter matrix;
step 3.6: computing query vectors by dot productAnd key vector->Similarity between the two to obtain similarity scoring functionWherein d is h Dimension size for head space;
step 3.7: score functionAttention weighting by softmax normalization
Step 3.8: by attention weight a i,j Vector of valuesWeighted summation is carried out to obtain e x High-order feature representation +.>
Step 3.9: increasing the cyclic variable i 2 Is jumped to step 3.4;
step 3.10: ending the cycle, splicing all the head space learned high-order feature vectors, and then performing linear transformation to obtain the short-term preference representation of the userWhere N is the number of head spaces, and W N Is a linear projection matrix.
Further, the specific method in the step 4 is as follows:
step 4.1: defining a time interval set T= { E, W, M, S } which respectively represents a day, a week, a month and a season;
step 4.2: defining a user set U, a project set I and defining the score of the user U to the network security tool item within time t as r ui ；
Step 4.3: definition of the loop variable i 3 And i 3 Giving an initial value of 1;
step 4.4: if i 3 If not more than len (T), jumping to the step 4.4, otherwise jumping to the step 4.8;
step 4.5: calculating the weighted scoring frequency of the user u to the network security tool class j in the time interval tWherein I is t Representing a set of user u scoring the network security tool during time interval t, B ij Indicating whether i belongs to the category j, is 1, and is 0;
step 4.6: calculating the variance of user u scores of various network security tools in time interval tWherein->The weighted score of the user u to the category j is represented, and C is the number of the categories;
step 4.7: increasing the cyclic variable i 3 Is jumped to step 4.4;
step 4.8: ending the cycle, and averaging the score variances of different time intervals to obtain the integral score variance of the user uWherein P represents the size of the set of time intervals T;
step 4.9: the user's preference fluctuation value is
Further, the specific method in the step 5 is as follows:
step 5.1: will prefer the fluctuation value F u Mapped to a vector F u Vector conversion is carried out by using the full connection layer to obtain F with the same length u _vec；
Step 5.2: the long-term preference, short-term preference, user feature vector and preference fluctuation value of the user are subjected to multi-mode fusion to obtain a target feature vectorWherein Concat represents a splicing operation, +.>Representing short-term preferences of the user g t Representing the long-term preference of the user, e u Representing user feature vectors, F u Vec represents the user's preference fluctuation vector;
step 5.3: inputting the target feature vector G into a fully-connected neural network to perform nonlinear transformation;
step 5.4: the network hidden layer learns the nonlinear relationship using a Dice-activated function;
step 5.5: the output layer calculates the prediction probability using Softmax functionWherein W is H As a trainable parameter matrix, b H As offset vector, D H For hidden layer output of layer H, +.>Representing the probability of recommending the next network security tool.
The invention also discloses a network security tool intelligent recommendation device based on the time sequence space characteristics and the preference fluctuation, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the network security tool intelligent recommendation method based on the time sequence space characteristics and the preference fluctuation is realized when the computer program is loaded to the processor.
The beneficial effects are that:
the invention mainly learns the long-term preference, the short-term preference and the preference fluctuation value of the user through the space-time GRU algorithm, the attention mechanism and the preference fluctuation technology to learn the overall preference of the user, thereby more accurately and efficiently recommending the next position. The continuous time factor is discretized by the improved GRU algorithm, a specific time conversion matrix and a specific distance conversion matrix are introduced, and the long-term behavior characteristics of a user can be more accurately captured by considering time and space factors, and the gradient descent problem in the traditional circulating neural network model can be avoided. Meanwhile, through a multi-head attention mechanism, the most relevant characteristics can be extracted from the short-term behaviors of the user so as to accurately represent the short-term interests of the user. The preference fluctuation is used for predicting the current interest of the user more accurately by analyzing the preference change trend of the user at different times; most importantly, the space-time information, the user characteristics, the long-term and short-term preferences and the preference fluctuation vector are comprehensively fused to generate comprehensive user interest characteristics, personalized and high-quality network security tool recommendation can be more accurately carried out, and network security is further improved.
Drawings
FIG. 1 is a general flow chart of the present invention;
FIG. 2 is a flow chart of data preprocessing;
FIG. 3 is a flow chart of a long-term preference of a space-time GRU algorithm learning user;
FIG. 4 is a flowchart of a multi-head attention machine learning user short-term preferences;
FIG. 5 is a flow chart for calculating user preference fluctuation values using a network security tool.
Detailed Description
The present invention is further illustrated below in conjunction with specific embodiments, it being understood that these embodiments are meant to be illustrative of the invention only and not limiting the scope of the invention, and that modifications of the invention, which are equivalent to those skilled in the art to which the invention pertains, will fall within the scope of the invention as defined in the claims appended hereto.
The invention discloses an intelligent recommendation method and device for network security tools based on time sequence spatial characteristics and preference fluctuation, which are specifically disclosed as follows:
step 1: and cleaning and preprocessing the collected data of the user using the network security tool, and constructing a historical behavior sequence of the user.
Step 1.1: define user set u= { U 1 ,u 2 ,...,u a ,...u len(U) }，u a Is the a-th information data to be cleaned in U, wherein len (U) is the data quantity in U, and the variable a E [1, len (U)]。
Step 1.2: define network security tool set i= { I 1 ,i 2 ,...,i b ,...i len(I) }，i b Is the b information data to be cleaned in I, wherein len (I) is the data quantity in I, and the variable b E [1, len (I)]In this embodiment, the network security tool is a variety of software, hardware or services (e.g., antivirus software, vulnerability scanner) for protecting computers and network systemsData encryption tools, authentication tools, etc.).
Step 1.3: and performing duplicate removal and null removal on the data in the data set U, I.
Step 1.4: resulting in a cleaned dataset u1= { U 1 ,u 2 ,...,u a ,...u len(U) }，u a Is the a-th information data in U1, wherein len (U) is the data quantity in U, and the variable a E [1, len (U)]And dataset i1= { I 1 ,i 2 ,...,i b ,...i len(I) }，i b Is the b information data in I1, where len (I1) is the number of data in I1, variable b.epsilon.1, len (I1)]。
Step 1.5: defining a historical behavior sequence of a user asWherein->A network security tool representing previous interactions of the user, < +.>X u The subscript i of (2) indicates the order in which the network security tool appears in the sequence.
Step 1.6: for the user set U1, a user embedding matrix E is obtained by a method of embedding high-dimensional sparse single thermal codes into low-dimensional dense feature vectors u ，e u Representing the user feature vector.
Step 1.7: historical behavior sequence for a userThe method for embedding the high-dimensional sparse single thermal code into the low-dimensional dense feature vector is adopted to obtain a user behavior sequence embedding matrix E x ∈R n×k Where n x k represents the dimension of the matrix, e x Representing the sequence of user behavior embedding vectors.
Step 2: long-term preferences of users using network security tools are learned through spatiotemporal GRU algorithms. The space-time GRU algorithm is improved, continuous time factors are discretized, and a specific time conversion matrix and a specific distance conversion matrix are introduced.
Step 2.1: input user behavior sequence embedding matrix E x ∈R n×k 。
Step 2.2: a loop variable i is defined and has an initial value of 1.
Step 2.3: if i.ltoreq.len (X) u ) Then the step is skipped to step 2.4, otherwise the step is skipped to step 2.13.
Step 2.4: acquiring a user behavior sequence embedding matrix E x ∈R n×k Line i vector e in (a) x 。
Step 2.5: embedding vector e according to user behavior sequence x Can obtain The vector of the access position of the user u at the time t is expressed, and the hidden state vector of the user at the previous time t-1 is defined as h t-1 。
Step 2.6: defining a particular time transformation matrixFor representing two points in time t and t i Time interval t-t between i Wherein t is i Representing a historical point in time.
Step 2.7: defining a particular distance conversion matrixEuclidean distance between two geographic coordinates, and the calculation formula is +.>Wherein (1)>And->Coordinates representing the position visited by user u at time t,/->And->Indicating the user u history time t i Coordinates of the accessed location.
Step 2.8: computing input gateWherein W is i1 、W i2 Is a transformation matrix, W i3 、W i4 Is->And->Transfer matrix of b) i Is the bias vector.
Step 2.9: door for calculating forgetfulnessWherein W is f1 、W f2 Is a transformation matrix, W f3 、W f4 Is->And->Transfer matrix of b) f Is a bias vector;
step 2.10: according to a time conversion matrixAnd distance conversion matrix>Calculating a new GRU candidate hidden state vector +.>Wherein h is t-1 Hidden state vector, W, representing GRU at previous time c1 、W c4 Is a transformation matrix and W c2 、W c3 Is->And->Transfer matrix of b) c Is the bias vector.
Step 2.11: according to input gate i t And candidate hidden state vectorsUpdating hidden state vectors
Step 2.12: the value of the loop variable i is increased and the process goes to step 2.4.
Step 2.13: ending the cycle, obtaining the output of the final GRU (GRU) through the tanh nonlinear activation function, namely the long-term preference g of the user t ＝tanh(C t )。
Step 3: the short-term preference of the user is represented by learning recent usage of the web-safe tool preferences of the user by the multi-head attention machine.
Step 3.1: input user behavior sequence embedding matrix E x ∈R n×k 。
Step 3.2: cycle variable i 2 And i 2 The initial value is 1.
Step 3.3: if i 2 ≤len(X u ) Then jump to step 3.4 otherwise jump to step 3.10.
Step 3.4: acquiring a user behavior sequence embedding matrix E x ∈R n×k I of (a) 2 Line vector e x 。
Step 3.5: in head space h, user behavior is embedded into vector e by three different linear transformations x Mapping to query vectorsKey vector->Sum vector->The calculation formula is as follows: /> Wherein the method comprises the steps ofRepresenting a trainable parameter matrix.
Step 3.6: computing query vectors by dot productAnd key vector->Similarity between the two to obtain similarity scoring functionWherein d is h Is the dimension of the head space.
Step 3.7: score functionAttention weighting by softmax normalization
Step 3.8: by attention weight a i,j Vector of valuesWeighted summation is carried out to obtain e x High-order feature representation +.>
Step 3.9: increasing the cyclic variable i 2 Is skipped to step 3.4.
Step 3.10: ending the cycle, splicing all the head space learned high-order feature vectors, and then performing linear transformation to obtain the short-term preference representation of the userWhere N is the number of head spaces, and W N Is a linear projection matrix.
Step 4: a user's usage network security tool preference fluctuation value is calculated.
Step 4.1: the set of defined time intervals t= { E, W, M, S } represents day, week, month, and season, respectively.
Step 4.2: defining a user set U, a project set I and defining the score of the user U to the network security tool item within time t as r ui 。
Step 4.3: definition of the loop variable i 3 And i 3 The initial value is 1.
Step 4.4: if i 3 And (4) jumping to the step 4.4 if the flow rate is less than or equal to len (T), otherwise jumping to the step 4.8.
Step 4.5: calculating the weighted scoring frequency of the user u to the network security tool class j in the time interval tWherein I is t Representing a set of user u scoring the network security tool during time interval t, B ij Indicating whether i belongs to category j (yes 1, no 0).
Step 4.6: calculating the variance of user u scores of various network security tools in time interval tWherein->The weighted score of user u for category j is represented, and C is the number of categories.
Step 4.7: increasing the cyclic variable i 3 Is skipped to step 4.4.
Step 4.8: ending the cycle, and averaging the score variances of different time intervals to obtain the integral score variance of the user uWhere P denotes the size of the set of time intervals T.
Step 4.9: the user's preference fluctuation value is
Step 5: and fusing the long-term preference, the short-term preference, the user characteristic vector and the preference fluctuation vector of the user to obtain the comprehensive characteristic expression of the user using the network security tool behavior and recommending the comprehensive characteristic expression.
Step 5.1: will prefer the fluctuation value F u Mapped to a vector F u Vector conversion is carried out by using the full connection layer to obtain F with the same length u _vec。
Step 5.2: the long-term preference, short-term preference, user feature vector and preference fluctuation value of the user are subjected to multi-mode fusion to obtain a target feature vectorWherein Concat represents a splicing operation, +.>Representing short-term preferences of the user g t Representing the long-term preference of the user, e u Representing user feature vectors, F u And _vec represents the preference fluctuation vector of the user.
Step 5.3: and inputting the target feature vector G into a fully connected neural network to perform nonlinear transformation.
Step 5.4: the network hidden layer learns the nonlinear relationship using a Dice-activated function.
Step 5.5: the output layer calculates the prediction probability using Softmax functionWherein W is H As a trainable parameter matrix, b H As offset vector, D H For hidden layer output of layer H, +.>Representing the probability of recommending the next network security tool.
The intelligent recommendation method for the network security tool based on the time sequence space characteristics and the preference fluctuation is stored in a memory by a computer program, and the intelligent recommendation device for the network security tool based on the time sequence space characteristics and the preference fluctuation is formed together with the memory and a processor, and the intelligent recommendation method for the network security tool based on the time sequence space characteristics and the preference fluctuation is realized when the computer program is loaded to the processor.
The foregoing embodiments are merely illustrative of the technical concept and features of the present invention, and are not intended to limit the scope of the invention in any way, as will be apparent to those skilled in the art from the following detailed description. All equivalent changes or modifications made in accordance with the spirit of the invention should be made within the scope of the present invention.
Claims (7)
1. The intelligent network security tool recommendation method based on time sequence space characteristics and preference fluctuation is characterized by comprising the following steps of:
step 1: cleaning and preprocessing collected data of a user using a network security tool, and constructing a historical behavior sequence of the user, wherein the historical behavior sequence comprises a user embedding matrix and a user behavior sequence embedding matrix, and the user embedding matrix and the user behavior sequence embedding matrix respectively comprise user characteristic vectors and user behavior sequence embedding vectors;
step 2: taking a user behavior sequence embedding matrix as input, and learning the long-term preference of a user for using a network security tool through an improved space-time GRU algorithm; the improved space-time GRU algorithm discretizes the continuous time factor and introduces a specific time conversion matrix and a specific distance conversion matrix;
step 3: the method comprises the steps that a user behavior sequence embedding matrix is used as input, recent network security tool preference using by a user is learned through a multi-head attention machine, and short-term preference of the user is represented;
step 4: computing user's usage network security tool preference fluctuation value F u ；
Step 5: and fusing the long-term preference, the short-term preference, the user characteristic vector and the preference fluctuation vector of the user to obtain the comprehensive characteristic expression of the user using the network security tool behavior and recommending the comprehensive characteristic expression.
2. The intelligent recommendation method for network security tools based on time sequence space characteristics and preference fluctuation according to claim 1, wherein the specific method of step 1 is as follows:
step 1.1: define user set u= { U 1 ,u 2 ,...,u a ,...u len(U) }，u a Is the a-th information data to be cleaned in U, wherein len (U) is the data quantity in U, and the variable a E [1, len (U)]；
Step 1.2: define network security tool set i= { I 1 ,i 2 ,...,i b ,...i len(I) }，i b Is the b information data to be cleaned in I, wherein len (I) is the data quantity in I, and the variable b E [1, len (I)]；
Step 1.3: performing deduplication and nulling operations on the data in the dataset U, I;
step 1.4: resulting in a cleaned dataset u1= { U 1 ,u 2 ,...,u a ,...u len(U) }，u a Is the a-th information data in U1, wherein len (U) is the data quantity in U, and the variable a E [1, len (U)]And dataset i1= { I 1 ,i 2 ,...,i b ,...i len(I) }，i b Is the b information data in I1, where len (I1) is the number of data in I1, variable b.epsilon.1, len (I1)]；
Step 1.5: defining a historical behavior sequence of a user asWherein->A network security tool representing previous interactions of the user, < +.>X u The subscript i of (1) indicates the order in which the network security tool appears in the sequence;
step 1.6: for the user set U1, a user embedding matrix E is obtained by a method of embedding high-dimensional sparse single thermal codes into low-dimensional dense feature vectors u ，e u Is a user embedding matrix E u Representing a user feature vector;
step 1.7: historical behavior sequence for a userThe method for embedding the high-dimensional sparse single thermal code into the low-dimensional dense feature vector is adopted to obtain a user behavior sequence embedding matrix E x ∈R n×k Where n x k represents the dimension of the matrix, e x Is a vector in the user behavior sequence embedding matrix, and represents the user behavior sequence embedding vector.
3. The intelligent recommendation method for network security tools based on time sequence space characteristics and preference fluctuation according to claim 1, wherein the specific method of the step 2 is as follows:
step 2.1: input user behavior sequence embedding matrix E x ∈R n×k ；
Step 2.2: defining a cyclic variable i, wherein the initial value of i is 1;
step 2.3: if i.ltoreq.len (X) u ) Step 2.4 is skipped, otherwise step 2.13 is skipped;
step 2.4: acquiring a user behavior sequence embedding matrix E x ∈R n×k Line i vector e in (a) x ；
Step 2.5: embedding vector e according to user behavior sequence x Obtaining The vector of the access position of the user u at the time t is expressed, and the hidden state vector of the user at the previous time t-1 is defined as h t-1 ；
Step 2.6: defining a particular time transformation matrixFor representing two points in time t and t i Time interval t-t between i Wherein t is i Representing a historical time point;
step 2.7: defining a particular distance conversion matrixEuclidean distance between two geographic coordinates, and the calculation formula is +.>Wherein (1)>And->Representing the coordinates of the location visited by user u at time t,and->Indicating the user u history time t i Coordinates of the accessed location;
step 2.8: computing input gateWherein W is i1 、W i2 Is a transformation matrix, W i3 、W i4 Is->And->Transfer matrix of b) i Is the bias vector, σ is the activation function, h t-1 Is the hidden state vector of the GRU at the previous moment;
step 2.9: door for calculating forgetfulnessWherein W is f1 、W f2 Is a transformation matrix, W f3 、W f4 Is->And->Transfer matrix of b) f Is a bias vector;
step 2.10: according to a time conversion matrixAnd distance conversion matrix>Computing new GRU candidate hidden state vectorsWherein h is t-1 Hidden state vector, W, representing GRU at previous time c1 、W c4 Is a transformation matrix and W c2 、W c3 Is->And->Transfer matrix of b) c Is a bias vector;
step 2.11: according to input gate i t And candidate hidden state vectorsUpdating hidden state vectors
Step 2.12: increasing the value of the circulation variable i, and jumping to the step 2.4;
step 2.13: ending the cycle, obtaining the output of the final GRU (GRU) through the tanh nonlinear activation function, namely the long-term preference g of the user t ＝tanh(C t )。
4. The intelligent recommendation method for network security tools based on time sequence space characteristics and preference fluctuation according to claim 1, wherein the specific method of the step 3 is as follows:
step 3.1: input user behavior sequence embedding matrix E x ∈R n×k ；
Step 3.2: cycle variable i 2 And i 2 Giving an initial value of 1;
step 3.3: if i 2 ≤len(X u ) Jumping to step 3.4, otherwise jumping to step 3.10;
step 3.4: acquiring a user behavior sequence embedding matrix E x ∈R n×k I of (a) 2 Line vector e x ；
Step 3.5: in head space h, user behavior is embedded into vector e by three different linear transformations x Mapping to query vectorsKey vector->Sum vector->The calculation formula is as follows: /> Wherein the method comprises the steps ofRepresenting a trainable parameter matrix;
step 3.6: computing query vectors by dot productAnd key vector->Similarity between the two to obtain similarity scoring functionWherein d is h Dimension size for head space;
step 3.7: score functionAttention weighting by softmax normalization
Step 3.8: by attention weight a i,j Vector of valuesWeighted summation is carried out to obtain e x High-order feature representation +.>
Step 3.9: increasing the cyclic variable i 2 Is jumped to step 3.4;
step 3.10: ending the cycle, splicing all the head space learned high-order feature vectors, and then performing linear transformation to obtain the short-term preference representation of the userWhere N is the number of head spaces, and W N Is a linear projection matrix.
5. The intelligent recommendation method for network security tools based on time sequence space characteristics and preference fluctuation according to claim 1, wherein the specific method of the step 4 is as follows:
step 4.1: defining a time interval set T= { E, W, M, S } which respectively represents a day, a week, a month and a season;
step 4.2: defining a user set U, a project set I and defining the score of the user U to the network security tool item within time t as r ui ；
Step 4.3: definition of the loop variable i 3 And i 3 Giving an initial value of 1;
step 4.4: if i 3 If not more than len (T), jumping to the step 4.4, otherwise jumping to the step 4.8;
step 4.5: calculating the weighted scoring frequency of the user u to the network security tool class j in the time interval tWherein I is t Representing a set of user u scoring the network security tool during time interval t, B ij Indicating whether i belongs to the category j, is 1, and is 0;
step 4.6: calculating the variance of user u scores of various network security tools in time interval tWherein->The weighted score of the user u to the category j is represented, and C is the number of the categories;
step 4.7: increasing the cyclic variable i 3 Is jumped to step 4.4;
step 4.8: ending the cycle, and averaging the score variances of different time intervals to obtain the integral score variance of the user uWherein P represents the size of the set of time intervals T;
step 4.9: the user's preference fluctuation value is
6. The intelligent recommendation method for network security tools based on time sequence space characteristics and preference fluctuation according to claim 1, wherein the specific method of the step 5 is as follows:
step 5.1: will prefer the fluctuation value F u Mapped to a vector F u Vector conversion is carried out by using the full connection layer to obtain F with the same length u _vec；
Step 5.2: the long-term preference, short-term preference, user feature vector and preference fluctuation value of the user are subjected to multi-mode fusion to obtain a target feature vectorWherein Concat represents a splicing operation, +.>Representing short-term preferences of the user g t Representing the long-term preference of the user, e u Representing user feature vectors, F u Vec represents the user's preference fluctuation vector;
step 5.3: inputting the target feature vector G into a fully-connected neural network to perform nonlinear transformation;
step 5.4: the network hidden layer learns the nonlinear relationship using a Dice-activated function;
step 5.5: the output layer calculates the prediction probability using Softmax functionWherein W is H As a trainable parameter matrix, b H As offset vector, D H For hidden layer output of layer H, +.>Representing the probability of recommending the next network security tool.
7. A network security tool intelligent recommendation device based on time sequence space characteristics and preference fluctuation, comprising a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the computer program is loaded to the processor to realize the network security tool intelligent recommendation method based on time sequence space characteristics and preference fluctuation according to any one of claims 1-6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311653994.2A CN117763492B (en) | 2023-12-04 | 2023-12-04 | Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311653994.2A CN117763492B (en) | 2023-12-04 | 2023-12-04 | Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117763492A true CN117763492A (en) | 2024-03-26 |
| CN117763492B CN117763492B (en) | 2024-06-11 |
Family
ID=90311454
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311653994.2A Active CN117763492B (en) | 2023-12-04 | 2023-12-04 | Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117763492B (en) |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109062962A (en) * | 2018-06-27 | 2018-12-21 | 华南理工大学 | A kind of gating cycle neural network point of interest recommended method merging Weather information |
| CN110910215A (en) * | 2019-11-20 | 2020-03-24 | 深圳前海微众银行股份有限公司 | Product recommendation method, device, equipment and computer-readable storage medium |
| CN110929164A (en) * | 2019-12-09 | 2020-03-27 | 北京交通大学 | Interest point recommendation method based on user dynamic preference and attention mechanism |
| CN112488155A (en) * | 2020-11-09 | 2021-03-12 | 北京三快在线科技有限公司 | User information prediction method, device, equipment and medium |
| CN112861012A (en) * | 2021-03-09 | 2021-05-28 | 河南工业大学 | Recommendation method and device based on context and user long-term and short-term preference adaptive learning |
| CN113139140A (en) * | 2021-05-17 | 2021-07-20 | 辽宁工程技术大学 | Tourist attraction recommendation method based on space-time perception GRU and combined with user relation preference |
| CN114971784A (en) * | 2022-05-21 | 2022-08-30 | 内蒙古工业大学 | Graph neural network-based session recommendation method and system integrating self-attention mechanism |
| CN115757919A (en) * | 2022-11-24 | 2023-03-07 | 淮阴工学院 | Symmetric deep network and dynamic multi-interaction human resource post recommendation method |
| CN115952355A (en) * | 2022-12-05 | 2023-04-11 | 北京电子工程总体研究所 | Next interest point recommendation system based on space-time power law attention |
| CN115982468A (en) * | 2023-01-04 | 2023-04-18 | 重庆邮电大学 | Interest point recommendation method combining user periodic preference and short-term interest |
| US20230214925A1 (en) * | 2021-11-23 | 2023-07-06 | Strong Force TX Portfolio 2018, LLC | Transaction platforms where systems include sets of other systems |
-
2023
- 2023-12-04 CN CN202311653994.2A patent/CN117763492B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109062962A (en) * | 2018-06-27 | 2018-12-21 | 华南理工大学 | A kind of gating cycle neural network point of interest recommended method merging Weather information |
| CN110910215A (en) * | 2019-11-20 | 2020-03-24 | 深圳前海微众银行股份有限公司 | Product recommendation method, device, equipment and computer-readable storage medium |
| CN110929164A (en) * | 2019-12-09 | 2020-03-27 | 北京交通大学 | Interest point recommendation method based on user dynamic preference and attention mechanism |
| CN112488155A (en) * | 2020-11-09 | 2021-03-12 | 北京三快在线科技有限公司 | User information prediction method, device, equipment and medium |
| CN112861012A (en) * | 2021-03-09 | 2021-05-28 | 河南工业大学 | Recommendation method and device based on context and user long-term and short-term preference adaptive learning |
| CN113139140A (en) * | 2021-05-17 | 2021-07-20 | 辽宁工程技术大学 | Tourist attraction recommendation method based on space-time perception GRU and combined with user relation preference |
| US20230214925A1 (en) * | 2021-11-23 | 2023-07-06 | Strong Force TX Portfolio 2018, LLC | Transaction platforms where systems include sets of other systems |
| CN114971784A (en) * | 2022-05-21 | 2022-08-30 | 内蒙古工业大学 | Graph neural network-based session recommendation method and system integrating self-attention mechanism |
| CN115757919A (en) * | 2022-11-24 | 2023-03-07 | 淮阴工学院 | Symmetric deep network and dynamic multi-interaction human resource post recommendation method |
| CN115952355A (en) * | 2022-12-05 | 2023-04-11 | 北京电子工程总体研究所 | Next interest point recommendation system based on space-time power law attention |
| CN115982468A (en) * | 2023-01-04 | 2023-04-18 | 重庆邮电大学 | Interest point recommendation method combining user periodic preference and short-term interest |
Non-Patent Citations (7)
| Title |
|---|
| SIZHE YIN等: "Fusing User Preferences and Spatiotemporal Information for Sequential Recommendation", 《IEEE ACCESS 》, vol. 10, 22 August 2022 (2022-08-22), pages 89545 - 89554 * |
| TIANKUO LI等: "A spatiotemporal multi-feature extraction framework for opinion mining", 《NEUROCOMPUTING》, vol. 490, 14 June 2022 (2022-06-14), pages 337 - 346, XP087021420, DOI: 10.1016/j.neucom.2021.11.098 * |
| XIAOLING XIA等: "Based on Multiple Attention and User Preferences for Recommendation", 《2020 5TH INTERNATIONAL CONFERENCE ON MECHANICAL, CONTROL AND COMPUTER ENGINEERING (ICMCCE)》, 13 May 2021 (2021-05-13), pages 1102 - 1106 * |
| YAN CHENG等: "Sentiment Analysis Using Multi-Head Attention Capsules With Multi-Channel CNN and Bidirectional GRU", 《IEEE ACCESS》, vol. 9, 19 April 2021 (2021-04-19), pages 60383 - 60395, XP011851258, DOI: 10.1109/ACCESS.2021.3073988 * |
| 吴逸群: "基于用户偏好网络的点击率预估模型研究", 《中国优秀硕士学位论文全文数据库 (信息科技辑)》, no. 02, 15 February 2021 (2021-02-15), pages 138 - 2837 * |
| 张柯文等: "基于多特征双向门控神经网络的领域专家实体抽取方法", 《南京师大学报(自然科学版)》, vol. 44, no. 01, 25 January 2021 (2021-01-25), pages 128 - 135 * |
| 李全等: "融合时空感知GRU和注意力的下一个地点推荐", 《计算机应用》, vol. 40, no. 03, 25 October 2019 (2019-10-25), pages 677 - 682 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117763492B (en) | 2024-06-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Halim et al. | An effective genetic algorithm-based feature selection method for intrusion detection systems | |
| Lin et al. | A survey on reinforcement learning for recommender systems | |
| Chen et al. | A population-based incremental learning approach with artificial immune system for network intrusion detection | |
| Wang et al. | Automatic inference of demographic parameters using generative adversarial networks | |
| Nagra et al. | Hybrid self-inertia weight adaptive particle swarm optimisation with local search using C4. 5 decision tree classifier for feature selection problems | |
| Deore et al. | Hybrid optimization enabled robust CNN-LSTM technique for network intrusion detection | |
| Chen et al. | Learning multiple similarities of users and items in recommender systems | |
| Torres et al. | Active learning approach to label network traffic datasets | |
| Zhang et al. | Multi-metric learning for multi-sensor fusion based classification | |
| KR20220122741A (en) | Verification of authenticity of images | |
| Cheng et al. | Long-term effect estimation with surrogate representation | |
| Wang et al. | Interval-enhanced graph transformer solution for session-based recommendation | |
| Yang | Dynamic risk identification safety model based on fuzzy support vector machine and immune optimization algorithm | |
| Mehrkanoon et al. | Incremental multi-class semi-supervised clustering regularized by Kalman filtering | |
| Lee et al. | Effective evolutionary multilabel feature selection under a budget constraint | |
| Feng et al. | H-Diffu: hyperbolic representations for information diffusion prediction | |
| Liu et al. | Collaborative prediction for multi-entity interaction with hierarchical representation | |
| Yan et al. | Membership inference attacks against deep learning models via logits distribution | |
| CN117390289B (en) | House construction scheme recommending method, device and equipment based on user portrait | |
| He et al. | Learning informative representation for fairness-aware multivariate time-series forecasting: A group-based perspective | |
| CN117763492B (en) | Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation | |
| Xia et al. | Neural social recommendation with user embedding | |
| Wu et al. | Applying a Probabilistic Network Method to Solve Business‐Related Few‐Shot Classification Problems | |
| Wang et al. | Website recommendation with side information aided variational autoencoder | |
| Wen et al. | Recognizing activities from partially observed streams using posterior regularized conditional random fields |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |