WO2021259261A1 - 视频会议安全防护方法、设备及计算机可读存储介质 - Google Patents

视频会议安全防护方法、设备及计算机可读存储介质 Download PDF

Info

Publication number
WO2021259261A1
WO2021259261A1 PCT/CN2021/101544 CN2021101544W WO2021259261A1 WO 2021259261 A1 WO2021259261 A1 WO 2021259261A1 CN 2021101544 W CN2021101544 W CN 2021101544W WO 2021259261 A1 WO2021259261 A1 WO 2021259261A1
Authority
WO
WIPO (PCT)
Prior art keywords
video conference
sequence
security
information
communication information
Prior art date
Application number
PCT/CN2021/101544
Other languages
English (en)
French (fr)
Inventor
张航
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2021259261A1 publication Critical patent/WO2021259261A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G06N3/0442—Recurrent networks, e.g. Hopfield networks characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/084—Backpropagation, e.g. using gradient descent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/14—Systems for two-way working
    • H04N7/141—Systems for two-way working between two video terminals, e.g. videophone
    • H04N7/147—Communication arrangements, e.g. identifying the communication as a video-communication, intermediate storage of the signals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/14—Systems for two-way working
    • H04N7/15—Conference systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/09—Supervised learning

Definitions

  • the embodiments of the present application relate to, but are not limited to, the field of communication technology, and in particular, to a video conference security protection method, device, and computer-readable storage medium.
  • Video conference communication technology is currently widely used in various enterprises, organizations and teams to hold online meetings, and it is a major application of modern communication technology in multi-point interconnection scenarios.
  • video conference communication technology is no longer limited to realizing online meetings, but can also be used to realize intelligent online education, video surveillance networks, and terminal playback platforms.
  • more and more terminal devices are interconnected through video communication technology to transmit audio and video data to each other, which brings great convenience to users, but it is worth noting that this also introduces additional information security risks. And the risk of privacy leakage.
  • Participants of the video conference join the conference through video conference equipment, and these video conference equipment are interconnected to form a video conference venue. Participants of the video conference are in different locations in space, and communicate with each other through video conference equipment. Since the access modes and system status of these video conference equipment are different, if one of the video conference equipment is attacked or invaded, It may cause the information transmitted in the entire conference to be leaked or modified. Therefore, how to strengthen the security of the video conference device itself becomes particularly important.
  • the embodiments of the present application provide a video conference security protection method, equipment, and computer-readable storage medium.
  • the embodiments of the present application provide a video conference security protection method, including: acquiring video conference device communication information; using a pre-trained recurrent neural network model to process the video conference device communication information to obtain The device security status information corresponding to the communication information of the video conference device; when the device security status information triggers a security alarm, a security protection operation is performed.
  • an embodiment of the present application also provides a device, including: a memory, a processor, and a computer program stored in the memory and capable of running on the processor.
  • a device including: a memory, a processor, and a computer program stored in the memory and capable of running on the processor.
  • the processor executes the computer program, the above-mentioned On the one hand, the video conference security protection method.
  • an embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are used to execute the above-mentioned video conference security protection method.
  • FIG. 1 is a schematic diagram of a system architecture for implementing a video conference security protection method provided by an embodiment of the present application
  • FIG. 2 is a flowchart of a video conference security protection method provided by an embodiment of the present application
  • FIG. 3 is a flowchart of a video conference security protection method provided by another embodiment of the present application.
  • FIG. 4 is a schematic diagram of the communication information of the video conference device received by the video conference device provided by an embodiment of the present application;
  • FIG. 5 is a schematic diagram of a cyclic neural network model including a GRU unit provided by an embodiment of the present application
  • FIG. 6 is a schematic structural diagram of a GRU unit provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a many-to-one input and output system formed by a cyclic neural network model provided by an embodiment of the present application;
  • FIG. 8 is a flowchart of a video conference security protection method provided by another embodiment of the present application.
  • This application provides a video conference security protection method, equipment, and computer readable storage medium.
  • the video conference device obtains the communication information of the video conference device, and uses a pre-trained recurrent neural network model to process the communication information of the video conference device.
  • the device security status information corresponding to the communication information of the video conference device is obtained. If the device security status information triggers a security alarm, it means that the video conference device is currently under attack or intrusion. At this time, the video conference device can perform security Protective operations to prevent the information transmitted in the video conference from being leaked or modified, thereby improving the security of the video conference equipment.
  • FIG. 1 is a schematic diagram of a system architecture for executing a video conference security protection method provided by an embodiment of the present application.
  • the system architecture includes a first video conference device 110, a second video conference device 120, and a server 130, wherein the first video conference device 110 and the second video conference device 120 are in communication connection, and, The first video conference device 110 and the second video conference device 120 are respectively connected to the server 130 in communication.
  • the first video conference device 110 and the second video conference device 120 both include a system audit module 111, a model loading module 112, a flow sequence identification module 113, a security status alarm module 114, and a security protection module 115, wherein the model loading module 112,
  • the flow sequence identification module 113, the security status alarm module 114, and the security protection module 115 are connected in sequence, and the system audit module 111 and the security status alarm module 114 are connected.
  • the security status alarm module 114 of the first video conference device 110 is in communication connection with the security protection module 115 of the second video conference device 120, and the security protection module 115 of the first video conference device 110 is connected to the security protection module 115 of the second video conference device 120.
  • the security status alarm module 114 is in communication connection.
  • the server 130 includes a model learning module 131, which is respectively communicatively connected with the model loading module 112 in each video conference device.
  • the model learning module 131 uses a gated recurrent neural network to construct a classification prediction model for obtaining equipment safety status information.
  • the gated recurrent neural network includes, but is not limited to, a Long Short-Term Memory (LSTM) neural network or a gated recurrent unit (Gated Recurrent Unit, GRU) neural network.
  • the classification prediction model can iteratively learn the weight parameters and deviation values and the adopted hyperparameters by optimizing the target loss method, and control the attack category according to the set protection granularity.
  • the types of attacks may include, but are not limited to, denial of service (Denial of Service, DoS) attacks, man-in-the-middle attacks, honeypot attacks, and so on.
  • the training data used to train the classification prediction model can be obtained by capturing data generated by simulating an actual attack model, or by using attack data obtained in actual engineering implementation, which is not specifically limited in this embodiment.
  • the system audit module 111 uses system audit technology to audit the system status of the video conference device, and is configured to determine whether there is unauthorized local access.
  • system auditing techniques include but are not limited to rule set matching and virus database matching.
  • the model loading module 112 is configured to download the trained classification prediction model from the model learning module 131 of the server 130.
  • the model loading module 112 may also have the ability to actively request the server 130 to update the classification prediction model.
  • the flow sequence identification module 113 can obtain the video conference device communication information received by the video conference device through data packet capture technology, and can filter and cut the video conference device communication information to form a video conference flow sequence.
  • the flow sequence identification module 113 can also sample the video conference traffic sequence, and input the sampled data into the classification prediction model, so that the corresponding equipment security status information can be obtained through the classification prediction model.
  • the video conference traffic sequence refers to a data sequence with a certain time gap formed by data information related to the video conference arriving at the video conference device in a certain order.
  • the foregoing manner of sampling the video conference traffic sequence may include, but is not limited to, a sliding window sampling manner.
  • the above-mentioned data packet capture technology includes but is not limited to Libpcap technology (network data packet capture function package under Unix or Linux platform, which can work under most Unix-like platforms) and data plane development kit (Data Plane Development Kit, DPDK) Technology.
  • the security status alarm module 114 is configured to obtain device security status information from the flow sequence identification module 113 and the system audit module 111. If the device security status information triggers a security alarm, the security status alarm module 114 can use the preset security status channel to The security status or security alarm of the local video conference device notifies other video conference devices participating in the video conference, and triggers the security protection module 115 of the local video conference device to perform a security protection operation in response.
  • the security status channel is a transmission channel through which video conferencing devices send device security status information to each other. It can be, but not limited to, INFO, MESSAGE, or NOTIFY based on Session Initiation Protocol (SIP). Notification) and other methods.
  • the security protection module 115 is configured to perform the security protection operation of the local video conference equipment in response to the trigger signal of the security status alarm module 114.
  • the security protection module 115 can also receive equipment security status information shared by other video conference equipment, and Perform security protection responses to other video conferencing devices based on the device security status information shared by other video conferencing devices.
  • FIG. 1 does not constitute a limitation on the embodiment of the present application, and may include more or less components than shown in the figure, or combine certain components, or be different.
  • the layout of the components may include more or less components than shown in the figure, or combine certain components, or be different.
  • the system audit module 111 In the system architecture shown in FIG. 1, the system audit module 111, the model loading module 112, the flow sequence identification module 113, the security status alarm module 114, and the security protection module in the first video conference device 110 and the second video conference device 120 Between 115, you can cooperate with the implementation of video conference security protection methods.
  • the server 130 may also be equipped with a system audit module 111, a model loading module 112, a flow sequence identification module 113, a security status alarm module 114, and a security protection module 115. Therefore, the system audit in the server 130 The module 111, the model loading module 112, the flow sequence identification module 113, the security status alarm module 114, and the security protection module 115 can also cooperate with each other to implement the video conference security protection method, thereby playing a security protection role for the server 130 .
  • FIG. 2 is a flowchart of a video conference security protection method provided by an embodiment of the present application.
  • the video conference security protection method includes but is not limited to step S100, step S200, and step S300.
  • Step S100 Obtain the communication information of the video conference device.
  • the video conference device when the video conference device is in the video conference access call phase or the video conference has been connected, the video conference device will interact with the network side. Therefore, the video conference device will receive data from the network side.
  • the video conference equipment communication information where the video conference equipment communication information includes all the data information above the physical layer received by the video conference equipment.
  • the attack or intrusion is usually initiated by the network side.
  • the attack data or intrusion data is mixed in the normal communication information of the video conference device. If the video conference device parses and processes the mixed information
  • the communication information of the video conference device that attacks or intrudes the data will cause the video conference device to be maliciously invaded, which will cause the leakage or modification of the information transmitted in the video conference.
  • the data packet capture technology can be used to obtain the communication information of the video conference device.
  • the Libpcap technology can be used to obtain the communication information of the video conference device, or the DPDK technology can be used to obtain the communication information of the video conference device.
  • the DPDK technology can be used to obtain the communication information of the video conference device.
  • step S200 the pre-trained cyclic neural network model is used to process the communication information of the video conference equipment, and obtain equipment security status information corresponding to the communication information of the video conference equipment.
  • the pre-trained recurrent neural network model can be used to simulate the mapping relationship between the communication information of the video conferencing device and the security status information of the device. Therefore, when the communication information of the video conferencing device is obtained, the pre-trained The cyclic neural network model processes the communication information of the video conferencing equipment, and obtains the equipment security status information corresponding to the communication information of the video conferencing equipment, so that the security status information of the equipment can be judged in the subsequent steps, so as to determine the attack Or, corresponding security protection operations can be performed when intruding, so that the security of the video conferencing equipment can be improved.
  • the cyclic neural network model can have different implementations, for example, it can be an LSTM neural network model or a GRU neural network model, which is not specifically limited in this embodiment.
  • Step S300 when the device security status information triggers a security alarm, perform a security protection operation.
  • the device security status information when the device security status information triggers a security alarm, it indicates that the video conference device is currently under attack or intrusion. Therefore, in order to avoid leakage or modification of the information transmitted in the video conference, security protection operations need to be performed , So as to ensure the security of video conferencing equipment.
  • the video conference device can obtain the communication information of the video conference device and use the pre-trained cyclic neural network model to The video conference device communication information is processed to obtain the device security status information corresponding to the video conference device communication information. If the device security status information triggers a security alarm, it means that the video conference device is currently under attack or intrusion. , The video conference device can perform security protection operations to prevent the information transmitted in the video conference from being leaked or modified, thereby overcoming the defect of ignoring the security status of the video conference device in the existing video conference security protection technology, thereby improving Security of video conferencing equipment.
  • the server in the video conference can also execute the above-mentioned step S100, step S200, and step S300 to realize the security protection of the server, thereby improving the security of the video conference equipment.
  • step S200 may include but is not limited to the following steps:
  • Step S210 Convert the communication information of the video conference equipment into a video conference traffic sequence
  • Step S220 sampling the video conference traffic sequence to obtain a video conference traffic sub-sequence
  • step S230 the pre-trained recurrent neural network model is used to process the video conference traffic sub-sequence to obtain equipment security status information corresponding to the video conference traffic sub-sequence.
  • the video conference device communication information received by the video conference device is a kind of network data from the network, and the largest unit of the video conference device communication information is an Ethernet frame.
  • FIG. 4 is a schematic diagram of the communication information of the video conference device received by the video conference device. Each data frame in Figure 4 represents the Ethernet frame received by the video conference device.
  • the communication information of the video conference device can be sent by different video conference devices in the video conference, which are different in time and space. , And the frame size is also different, these Ethernet frames arrive at the video conference device in a certain order, which can form a data sequence.
  • the communication information of the video conference equipment can be converted into a video conference flow sequence, and then use the pre-trained recurrent neural network model between the communication information of the video conference equipment and the equipment security status information.
  • the corresponding device security status information can be obtained, so that the device security status information can be judged in the subsequent steps, so that the corresponding security protection operations can be performed when it is determined that it is attacked or intruded.
  • the security of the video conferencing equipment can be improved.
  • the video conference traffic sequence with continuous data can be sampled first to obtain the corresponding video conference traffic sub-sequence with limited data, and then the video conference traffic sub-sequence can be obtained.
  • the sequence is input into the cyclic neural network model, so that the cyclic neural network model can more conveniently perform data processing to obtain equipment security status information corresponding to the video conference traffic sub-sequence.
  • sampling can be done in a sliding window mode, or sampling in an equal time interval.
  • the down-sampling interpolation method can also be used for sampling, which is not specifically limited in this embodiment.
  • FIG. 5 is an embodiment of a recurrent neural network model including a GRU unit.
  • the specific structure of the GRU unit is shown in FIG. 6, and the recurrent neural network model can finally be A many-to-one input-output system as shown in Figure 7 is formed.
  • the GRU unit is mainly used to process the data sequence. It can calculate a part of the data sequence in a cyclic manner. Such a calculation is a time step, and each calculation is The result of the current input data and the hidden state of the previous time step.
  • the module marked with z is the update gate structure of the GRU unit
  • the module marked with r is the reset gate structure of the GRU unit
  • t represents the current time step
  • x t is the input of the current time step t Data
  • h t-1 is the hidden state value of the previous time step.
  • the update gate state value z t and the reset gate state value r t of the current time step can be calculated, where re
  • the gate state value r t can control whether h t-1 is expressed when the unit state c t is calculated in the current time step
  • the update gate state value z t can control whether the unit state c t calculated at the current time step is expressed as the current time step.
  • the hidden state value of the time step h t Among them, the calculation formula of each state value is as follows:
  • U r , U z and U c are the input weight parameters of the corresponding node in the GRU unit
  • W r , W z and W c are the hidden weight parameters of the corresponding node in the GRU unit
  • b r , b z and b c is the deviation value of the corresponding node in the GRU unit
  • ⁇ is the sigmoid activation function
  • the above-mentioned weight parameters can be obtained by fitting data through a backpropagation algorithm during the training process of the recurrent neural network model.
  • each hidden layer is provided with multiple neurons (for example, 128 neurons can be set), and each neuron is It is composed of GRU units as shown in Figure 6.
  • the input layer of the recurrent neural network model adopts a sequence embedding layer, and the output layer adopts a classification representation layer, where the classification representation layer can use the Softmax unit to express the prediction results as multiple distributions of input samples in multiple categories. Therefore, combined with the category labeling of the training data, the cyclic neural network model can identify the security status of the video conferencing device and the status when it is subjected to a specific attack.
  • the specific attack mentioned above may be, for example, a denial of service attack or an address resolution protocol (Address Resolution Protocol, ARP) spoofing attacks, etc. Therefore, when the recurrent neural network model is used to process the video conference traffic sub-sequence to obtain the corresponding device security status information, the device security status information can be judged in the subsequent steps to facilitate the determination of the attack or intrusion. Corresponding security protection operations can be performed, which can improve the security of video conferencing equipment.
  • ARP Address Resolution Protocol
  • step S210 may include but is not limited to the following steps:
  • Step S211 filtering and cutting the communication information of the video conference device to obtain pre-processing information
  • Step S212 Perform normalization processing and one-hot encoding processing on the pre-processed information to obtain a video conference traffic sequence.
  • the communication information of the video conference device can be processed to obtain the video conference traffic sequence, so that the recurrent neural network model can facilitate the processing of the video conference traffic sequence in the subsequent steps.
  • the communication information of the video conference device can be filtered and cropped to eliminate redundant fields and fixed fields in the communication information of the video conference device. (Such as the version information of the protocol, etc.) to obtain the preprocessed information, and then perform normalization and one-hot encoding processing on the preprocessed information to convert the preprocessed information with a complex data structure into the feature information with a simple and unified data structure.
  • the application layer protocol is converted into simple protocol types and subtypes, so as to obtain a video conference traffic sequence that can be conveniently processed by the recurrent neural network model.
  • the communication information of the video conference device is mainly composed of Ethernet frames
  • Each valid Ethernet frame is cropped into a data packet vector, and each data packet vector corresponds to a sequence time step in the video conference flow sequence.
  • the sequence time step has nothing to do with the time measurement, and only represents the data packet vector in the video conference flow sequence. Positional relationship.
  • the continuous data packet vector forms a video conference flow sequence, because the video conference flow sequence can express the current video conference device location through a certain mapping relationship Therefore, by using the recurrent neural network model to fit and model this mapping relationship, you can learn a classifier that uses the video conference traffic sequence to identify the security state of the video conference equipment. Therefore, when the video conference traffic is obtained After the sequence, use the recurrent neural network model to process the video conference traffic sequence to obtain the corresponding device security status information, so that the device security status information can be judged in the subsequent steps, so as to determine the Corresponding security protection operations can be performed during an attack or intrusion, so that the security of the video conference device can be improved.
  • step S220 may include but is not limited to the following steps:
  • the video conference traffic sequence is sampled by means of a sliding window to obtain the video conference traffic sub-sequence.
  • a sliding window can be used to sample the video conference traffic sequence, where the length of the sliding window and the sliding step length of the sliding window can be appropriately selected according to actual application conditions.
  • the length of the sliding window can be selected as 200, and the sliding step length of the sliding window can be set to half the length of the sliding window. Therefore, a video conference flow sub-sequence with 200 time steps can be formed. As shown in Figure 7, taking the video conference traffic sub-sequence of 6 time steps as an example, the data packet vector of the video conference traffic sub-sequence is input into the recurrent neural network model in the sequence of the sequence, and the video conference traffic sub-sequence can be obtained. The predicted probability of the equipment security status information corresponding to the sequence.
  • step S300 may include but is not limited to the following steps:
  • the security status information of the device triggers a security alarm and causes the video conference device to perform security protection operations
  • the access call of the video conference device can be stopped, and also It can perform local virus detection and killing and other security protection operations to prevent attacked or intruded video conferencing equipment from affecting the normal operation of the entire video conference.
  • the video conference device can also manage to the network The alarm information is reported on the video conference device so that the network manager can notify the participating devices of the entire video conference based on the alarm information reported by the video conference device, so as to prevent the information transmitted in the video conference from being leaked or modified, so as to improve the video The purpose of the security of the conference equipment.
  • the execution of the security protection operation in step S300 may also include but is not limited to the following steps:
  • the device security status information triggers a security alarm and causes the video conference device to perform security protection operations
  • the video conference equipment can also encrypt the transmission data in the video conference, so as to prevent the information transmitted in the video conference from being leaked or modified, so as to improve the security of the video conference equipment sexual purpose.
  • the video conference security protection method may further include but is not limited to the following steps:
  • the local video conference device when the local video conference device is determined to be attacked or intruded, in addition to performing local security protection operations, the local video conference device can also send alarm information to the peer device in the video conference. , So that the peer device in the video conference can hang up the current video conference in time or encrypt the transmission data in the video conference, so as to prevent the information transmitted in the video conference from being leaked or modified, so as to improve the security of the video conference equipment Purpose.
  • a dedicated signaling channel may be established between the video conference device under attack or intrusion and the peer device in the video conference to implement security alarms between the video conference devices in the video conference.
  • Message transmission so that each video conference device in the video conference can know in time whether there is an attack or intrusion of the video conference device, so that the corresponding security protection operation can be performed in time, and the information transmitted in the video conference can be prevented from leaking or being Modification to achieve the purpose of improving the security of video conferencing equipment.
  • the dedicated signaling channel can be implemented using methods such as INFO, MESSAGE, or NOTIFY based on the SIP protocol, which is not specifically limited in this embodiment.
  • the video conference security protection method may further include but is not limited to the following steps:
  • the corresponding peer device is hung up, or the transmission data in the video conference is encrypted.
  • the local video conference device when the local video conference device obtains the alarm information from the peer device in the video conference, it indicates that the peer device in the video conference has been attacked or intruded, in order to prevent the information transmitted in the video conference from leaking or leaking.
  • the local video conference device can hang up the corresponding peer device to prevent the peer device from affecting the normal progress of the entire video conference.
  • the local video conference device can also encrypt the video conference with the peer device in the video conference. This can prevent the information transmitted in the video conference from being leaked or modified, so as to achieve the purpose of improving the security of the video conference equipment.
  • the video conference security protection method may further include but is not limited to the following steps:
  • the pre-trained cyclic neural network model may be stored in the server. Therefore, when the video conference device needs to use the cyclic neural network model to process the communication information of the video conference device, the video conference device downloads directly from the server The pre-trained cyclic neural network model is sufficient, and the cyclic neural network model does not need to be trained locally, which can save the training time of the cyclic neural network model and improve the use of the cyclic neural network model to obtain equipment safety status information efficient.
  • the data generated by simulating the actual attack model can be used as the training data, or the attack data obtained in the actual project implementation can be used as the training data, and then , Construct a data set based on these training data, then randomly break the data set, and divide the randomly broken data set into training set, test set and validation set according to a certain ratio (for example, 8:1:1) , And then input the training set into the recurrent neural network model as shown in Figure 5, use an iterative learning strategy to learn the recurrent neural network model, and use the back propagation algorithm along time to update the weight value and bias of the recurrent neural network model Parameters, after each training round, use the verification set to verify the generated recurrent neural network model.
  • a certain ratio for example, 8:1:1
  • the trained recurrent neural network model can be saved as a file in HDF5 format through keras.
  • keras is an open source artificial neural network library that can be used for the design, debugging, evaluation, application and application of deep learning models. Visualization.
  • the video conference device when the video conference device downloads the pre-trained cyclic neural network model from the server, the video conference device can obtain the model file of the cyclic neural network model through the RESTful API interface provided by the server, and then the model The file is loaded as the actually used cyclic neural network model (that is, the classification prediction model), so that the cyclic neural network model can be directly used in the subsequent steps to obtain equipment security status information, so as to determine whether it has been attacked or based on the equipment security status information. Corresponding security protection operations can be performed in time when intruding, so that the security of video conferencing equipment can be improved.
  • an embodiment of the present application also provides a device, which includes a memory, a processor, and a computer program stored on the memory and running on the processor.
  • the processor and the memory can be connected by a bus or in other ways.
  • the memory can be used to store non-transitory software programs and non-transitory computer-executable programs.
  • the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices.
  • the memory may include a memory remotely provided with respect to the processor, and these remote memories may be connected to the processor through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
  • the device in this embodiment may include the system architecture in the embodiment shown in FIG. 1, and the device in this embodiment and the system architecture in the embodiment shown in FIG. 1 belong to the same inventive concept. Therefore, these embodiments have the same implementation principles and technical effects, which will not be described in detail here.
  • the non-transitory software programs and instructions required to implement the video conference security protection method of the foregoing embodiment are stored in the memory.
  • the video conference security protection method of the foregoing embodiment is executed, for example, the above-described video conference security protection method is executed.
  • the method steps S100 to S300 in FIG. 2 the method steps S210 to S230 in FIG. 3, and the method steps S211 to S212 in FIG. 8.
  • the device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • an embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions, and the computer-executable instructions are executed by a processor or a controller, for example, by the aforementioned
  • the execution of a processor in the terminal embodiment can make the above-mentioned processor execute the video conference security protection method in the above-mentioned embodiment, for example, execute the above-described method steps S100 to S300 in FIG. 2 and method step S210 in FIG. 3 To S230, the method steps S211 to S212 in FIG. 8.
  • the embodiments of the application include: obtaining the communication information of the video conference device; using the pre-trained cyclic neural network model to process the communication information of the video conference device to obtain the device security status information corresponding to the video conference device communication information; when the device security status information Trigger security alarms and perform security protection operations.
  • the video conference device obtains the communication information of the video conference device and uses a pre-trained recurrent neural network model to process the communication information of the video conference device to obtain the communication information corresponding to the video conference device.
  • Device security status information If the device security status information triggers a security alarm, it means that the video conferencing device is currently under attack or intrusion. At this time, the video conferencing device can perform security protection operations to prevent information transmitted in the video conference Leakage or modification occurs, which can improve the security of video conferencing equipment.
  • Computer storage medium includes volatile and non-volatile data implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media.
  • Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other storage technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer.
  • a communication medium usually contains computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. .

Abstract

一种视频会议安全防护方法、设备及计算机可读存储介质。其中，视频会议安全防护方法包括：获取视频会议设备通讯信息（S100）；利用循环神经网络模型对视频会议设备通讯信息进行处理，得到与视频会议设备通讯信息对应的设备安全状态信息（S200）；当设备安全状态信息触发安全告警，执行安全防护操作（S300）。

Description

视频会议安全防护方法、设备及计算机可读存储介质
相关申请的交叉引用
本申请基于申请号为202010592436.X、申请日为2020年06月24日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请实施例涉及但不限于通信技术领域，尤其涉及一种视频会议安全防护方法、设备及计算机可读存储介质。
背景技术
视频会议通讯技术目前被广泛地用于各类企业、组织和团队召开在线会议，是现代通讯技术在多点互联场景下的一种主要应用。而随着物联网技术的不断发展，视频会议通讯技术不再局限于用于实现在线会议，同时还可以被用于实现智能在线教育、视频监控网络以及终端播放平台等众多领域。目前，越来越多的终端设备开始通过视频通讯技术互联在一起，相互传输音视频数据，为用户带来了极大的便利，但值得注意的是，这同时也引入了额外的信息安全隐患和隐私泄露风险。
视频会议的参与者通过视频会议设备加入会议，这些视频会议设备互联在一起形成视频会议会场。视频会议的参与者在空间上处于不同的地点，彼此之间通过视频会议设备进行通信，由于这些视频会议设备的接入形式和系统状态各异，如果其中一个视频会议设备遭受了攻击或入侵，则有可能会使得整个会议中传输的信息泄露或被修改，因此，如何加强视频会议设备自身的安全性，变得尤为重要。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本申请实施例提供了一种视频会议安全防护方法、设备及计算机可读存储介质。
第一方面，本申请实施例提供了一种视频会议安全防护方法，包括：获取 视频会议设备通讯信息；利用预先训练好的循环神经网络模型对所述视频会议设备通讯信息进行处理，得到与所述视频会议设备通讯信息对应的设备安全状态信息；当所述设备安全状态信息触发安全告警，执行安全防护操作。
第二方面，本申请实施例还提供了一种设备，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上第一方面所述的视频会议安全防护方法。
第三方面，本申请实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行如上所述的视频会议安全防护方法。
本申请的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1是本申请一个实施例提供的用于执行视频会议安全防护方法的系统架构的示意图；
图2是本申请一个实施例提供的视频会议安全防护方法的流程图；
图3是本申请另一实施例提供的视频会议安全防护方法的流程图；
图4是本申请一个实施例提供的视频会议设备接收到的视频会议设备通讯信息的示意图；
图5是本申请一个实施例提供的包括有GRU单元的循环神经网络模型的示意图；
图6是本申请一个实施例提供的GRU单元的结构示意图；
图7是本申请一个实施例提供的由循环神经网络模型形成的多对一输入输出系统的示意图；
图8是本申请另一实施例提供的视频会议安全防护方法的流程图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实 施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
需要说明的是，虽然在装置示意图中进行了功能模块划分，在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于装置中的模块划分，或流程图中的顺序执行所示出或描述的步骤。说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本申请提供了一种视频会议安全防护方法、设备及计算机可读存储介质，视频会议设备通过获取视频会议设备通讯信息，并利用预先训练好的循环神经网络模型对该视频会议设备通讯信息进行处理而得到与该视频会议设备通讯信息对应的设备安全状态信息，如果该设备安全状态信息触发了安全告警，则说明该视频会议设备当前受到了攻击或者入侵，此时，该视频会议设备可以执行安全防护操作，以防止视频会议中传输的信息发生泄露或被修改，从而能够提高视频会议设备的安全性。
下面结合附图，对本申请实施例作进一步阐述。
如图1所示，图1是本申请一个实施例提供的用于执行视频会议安全防护方法的系统架构的示意图。在图1的示例中，该系统架构包括第一视频会议设备110、第二视频会议设备120和服务器130，其中，第一视频会议设备110和第二视频会议设备120之间通信连接，并且，第一视频会议设备110和第二视频会议设备120分别与服务器130通信连接。
第一视频会议设备110和第二视频会议设备120均包括有系统审计模块111、模型加载模块112、流量序列识别模块113、安全状态告警模块114和安全防护模块115，其中，模型加载模块112、流量序列识别模块113、安全状态告警模块114和安全防护模块115依次连接，系统审计模块111和安全状态告警模块114相连接。此外，第一视频会议设备110的安全状态告警模块114与第二视频会议设备120的安全防护模块115通信连接，并且，第一视频会议设备110的安全防护模块115与第二视频会议设备120的安全状态告警模块114通信连接。
服务器130包括有模型学习模块131，该模型学习模块131分别与每一个视频会议设备中的模型加载模块112通信连接。
模型学习模块131中利用门控循环神经网络构建有用于获得设备安全状态信息的分类预测模型。其中，门控循环神经网络包括但不限于为长短时记忆 (Long Short-Term Memory，LSTM)神经网络或门控循环单元(Gated Recurrent Unit，GRU)神经网络。该分类预测模型可以通过优化目标损失的方法对权重参数与偏差值以及所采用的超参数进行迭代学习，并按照设定的防护粒度对攻击类别进行控制。其中，攻击类别可以包括但不限于有拒绝服务(Denial of Service，DoS)攻击、中间人攻击和蜜罐攻击等。用于训练分类预测模型的训练数据，可以通过对模拟实际攻击模型所产生的数据进行抓取而得到，或者使用实际工程实施中所获取到的攻击数据，本实施例对此并不作具体限定。
系统审计模块111采用系统审计技术对视频会议设备的系统状态进行审计，被配置成判断是否存在未经授权的本地访问。其中，系统审计技术包括但不限于规则集匹配和病毒库匹配等。
模型加载模块112被配置成从服务器130的模型学习模块131中下载已经训练好的分类预测模型，此外，模型加载模块112还可以具备主动请求服务器130更新分类预测模型的能力。
流量序列识别模块113可以通过数据包捕获技术获取视频会议设备所接收到的视频会议设备通讯信息，并且可以对视频会议设备通讯信息进行过滤和裁剪，形成视频会议流量序列，此外，流量序列识别模块113还可以对视频会议流量序列进行采样，并把采样后得到的数据输入到分类预测模型中，从而可以通过分类预测模型得到对应的设备安全状态信息。其中，视频会议流量序列是指与视频会议相关的数据信息按照一定的次序抵达视频会议设备所形成的具有一定时间间隙的数据序列。上述对视频会议流量序列进行采样的方式可以包括但不限于滑动窗口采样方式。上述的数据包捕获技术包括但不限于Libpcap技术(Unix或Linux平台下的网络数据包捕获函数包，可以在绝大多数类Unix平台下工作)和数据平面开发套件(Data Plane Development Kit，DPDK)技术。
安全状态告警模块114被配置成从流量序列识别模块113和系统审计模块111中获取设备安全状态信息，如果设备安全状态信息触发了安全告警，安全状态告警模块114可以通过预设的安全状态通道将本地视频会议设备的安全状态或者安全告警通告参与视频会议的其他视频会议设备，并触发本地视频会议设备的安全防护模块115响应执行安全防护操作。其中，安全状态通道为视频会议设备之间相互发送设备安全状态信息的传输通道，可以采用但不限于基于会话初始协议(Session Initiation Protocol，SIP)的INFO(信息)、MESSAGE(消息)或NOTIFY(通知)等方法实现。
安全防护模块115被配置成响应安全状态告警模块114的触发信号而执行本地视频会议设备的安全防护操作，此外，安全防护模块115也可以接收由其他视频会议设备所共享的设备安全状态信息，并根据由其他视频会议设备所共享的设备安全状态信息对其他视频会议设备进行安全防护响应。
本申请实施例描述的系统架构以及应用场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域技术人员可知，随着系统架构的演变和新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本领域技术人员可以理解的是，图1中示出的系统架构的结构并不构成对本申请实施例的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
在图1所示的系统架构中，第一视频会议设备110和第二视频会议设备120中的系统审计模块111、模型加载模块112、流量序列识别模块113、安全状态告警模块114和安全防护模块115之间，均可以配合执行视频会议安全防护方法。
此外，在一实施例中，服务器130中也可以搭载有系统审计模块111、模型加载模块112、流量序列识别模块113、安全状态告警模块114和安全防护模块115，所以，服务器130中的系统审计模块111、模型加载模块112、流量序列识别模块113、安全状态告警模块114和安全防护模块115之间，也可以相互配合以执行视频会议安全防护方法，从而可以起到对服务器130的安全防护作用。
基于上述系统架构的结构，提出本申请的视频会议安全防护方法的各个实施例。
如图2所示，图2是本申请一个实施例提供的视频会议安全防护方法的流程图，该视频会议安全防护方法包括但不限于有步骤S100、步骤S200和步骤S300。
步骤S100，获取视频会议设备通讯信息。
在一实施例中，在视频会议设备处于视频会议接入呼叫阶段或者处于视频会议已接入阶段的情况下，视频会议设备都会与网络侧进行数据交互，因此视频会议设备会接收到来自网络侧的视频会议设备通讯信息，其中，视频会议设备通讯信息包括该视频会议设备所接收到的所有物理层以上的数据信息。而当视频会议设备遭受到攻击或者入侵时，该攻击或者入侵往往都是由网络 侧发起的，攻击数据或者入侵数据混杂在正常的视频会议设备通讯信息中，如果视频会议设备解析并处理混杂有攻击数据或者入侵数据的视频会议设备通讯信息，将会导致视频会议设备被恶意入侵，从而会造成视频会议中传输的信息发生泄露或被修改的问题。因此，通过获取视频会议设备通讯信息，可以使得后续步骤中能够根据该视频会议设备通讯信息判断视频会议设备是否遭到攻击或者入侵，以便于在确定遭到攻击或者入侵时可以执行对应的安全防护操作，从而能够提高视频会议设备的安全性。
在一实施例中，可以利用数据包捕获技术获取视频会议设备通讯信息，例如，可以采用Libpcap技术获取视频会议设备通讯信息，也可以采用DPDK技术获取视频会议设备通讯信息，本实施例对此并不作具体限定。
步骤S200，利用预先训练好的循环神经网络模型对视频会议设备通讯信息进行处理，得到与视频会议设备通讯信息对应的设备安全状态信息。
在一实施例中，可以利用预先训练好的循环神经网络模型模拟视频会议设备通讯信息和设备安全状态信息之间的映射关系，因此，当获取到视频会议设备通讯信息时，可以利用预先训练好的循环神经网络模型对视频会议设备通讯信息进行处理，得到与视频会议设备通讯信息对应的设备安全状态信息，从而可以在后续步骤中对该设备安全状态信息进行判断，以便于在确定遭到攻击或者入侵时可以执行对应的安全防护操作，从而能够提高视频会议设备的安全性。
在一实施例中，该循环神经网络模型可以有不同的实施方式，例如，可以为LSTM神经网络模型，也可以为GRU神经网络模型，本实施例对此并不作具体限定。
步骤S300，当设备安全状态信息触发安全告警，执行安全防护操作。
在一实施例中，当设备安全状态信息触发安全告警，说明视频会议设备当前处于被攻击或者被入侵的状态，因此，为了避免视频会议中传输的信息发生泄露或被修改，需要执行安全防护操作，从而能够保障视频会议设备的安全性。
在一实施例中，通过采用包括有上述步骤S100、步骤S200和步骤S300的视频会议安全防护方法，使得视频会议设备可以通过获取视频会议设备通讯信息，并利用预先训练好的循环神经网络模型对该视频会议设备通讯信息进行处理而得到与该视频会议设备通讯信息对应的设备安全状态信息，如果该设备安全状态信息触发了安全告警，则说明该视频会议设备当前受到了攻击或者入侵，此时，该视频会议设备可以执行安全防护操作，以防止视频会议 中传输的信息发生泄露或被修改，从而可以克服现有视频会议安全防护技术中忽略视频会议设备的设备安全状态的缺陷，从而能够提高视频会议设备的安全性。
值得注意的是，视频会议中的服务器也可以执行上述的步骤S100、步骤S200和步骤S300，以实现对服务器的安全防护，从而提高视频会议设备的安全性。
另外，在一实施例中，参照图3，步骤S200可以包括但不限于有以下步骤：
步骤S210，将视频会议设备通讯信息转化成视频会议流量序列；
步骤S220，对视频会议流量序列进行采样，得到视频会议流量子序列；
步骤S230，利用预先训练好的循环神经网络模型对视频会议流量子序列进行处理，得到与视频会议流量子序列对应的设备安全状态信息。
在一实施例中，视频会议设备所接收到的视频会议设备通讯信息是一种来自于网络的网络数据，视频会议设备通讯信息的最大单位为以太网帧。参考图4，图4是视频会议设备所接收到的视频会议设备通讯信息的示意图。图4中的每一个数据帧均表示视频会议设备所接收到的以太网帧，视频会议设备通讯信息可以是由视频会议中不同视频会议设备所发出的，其在时间上和空间上均不相同，并且帧大小也有区别，这些以太网帧按照一定的顺序到达视频会议设备，从而可以形成一种数据序列。基于视频会议设备通讯信息的上述数据特点，因此可以将视频会议设备通讯信息转化成视频会议流量序列，然后利用预先训练好的循环神经网络模型中的视频会议设备通讯信息和设备安全状态信息之间的映射关系，根据视频会议流量序列得到对应的设备安全状态信息，从而可以在后续步骤中对该设备安全状态信息进行判断，以便于在确定遭到攻击或者入侵时可以执行对应的安全防护操作，从而能够提高视频会议设备的安全性。
在一实施例中，为了方便循环神经网络模型对输入数据的处理，可以先对数据持续的视频会议流量序列进行采样而得到对应的数据有限的视频会议流量子序列，然后把该视频会议流量子序列输入到循环神经网络模型中，以便于循环神经网络模型能够更加方便的进行数据处理而得到与该视频会议流量子序列对应的设备安全状态信息。
值得注意的是，步骤S220中对视频会议流量序列进行采样的方法，可以有多种不同的实施方式，例如，可以采用滑动窗口的方式进行采样，也可以采 用等时间间隔采样的方式进行采样，还可以采用降采样插值方法进行采样，本实施例对此并不作具体限定。
在一实施例中，如图5所示，图5是包括有GRU单元的循环神经网络模型的一个实施例，其中，GRU单元的具体结构如图6所示，而循环神经网络模型最终则可以形成如图7所示的多对一输入输出系统。
在如图6所示的GRU单元中，该GRU单元主要用于处理数据序列，可通过循环的方式依次对数据序列中的一部分进行计算，这样的一次计算就是一个时间步，每次计算都是当前的输入数据和上一个时间步的隐藏状态共同作用的结果。在图6中，带有z标识的模块为GRU单元的更新门结构，带有r标识的模块为GRU单元的重置门结构，t表示当前的时间步，x t为当前时间步t的输入数据，h t-1为上一时间步的隐藏状态值，根据x t和h t-1可以计算得出当前时间步的更新门状态值z t和重置门状态值r t，其中，重置门状态值r t可以控制h t-1在当前时间步中计算单元状态c t时是否进行表达，更新门状态值z t可以控制当前时间步所计算出的单元状态c t是否表达为当前时间步的隐藏状态值h t。其中，各个状态值的计算公式如下：
r t＝σ(U r*x t+W r*h t-1+b r)
z t＝σ(U z*x t+W z*h t-1+b z)
Figure PCTCN2021101544-appb-000001
h t＝z t*h t-1+(1-z t)*c t
其中，U r、U z和U c分别为GRU单元中对应结点的输入权重参数，W r、W z和W c分别为GRU单元中对应结点的隐藏权重参数，b r、b z和b c分别为GRU单元中对应结点的偏差值，σ为sigmoid激活函数，
Figure PCTCN2021101544-appb-000002
为tanh激活函数，上述权重参数可以在循环神经网络模型的训练过程中通过反向传播算法拟合数据而得到。
在如图5所示的循环神经网络模型中，采用了2层隐藏层的结构，其中，每层隐藏层均设置有多个神经元(例如可以设置128个神经元)，每一个神经元均由如图6所示的GRU单元构成。另外，循环神经网络模型的输入层采用序列嵌入层，输出层采用分类表示层，其中，分类表示层可以利用Softmax单元将预测结果表示为输入样本在多个类别上的多项分布。因此，结合训练数据的类别标记，循环神经网络模型可以识别视频会议设备的安全状态以及受到特定攻击时的状态，其中，上述的特定攻击例如可以为拒绝服务攻击或地址解析协议(Address Resolution Protocol，ARP)欺骗攻击等。所以，当利用循环 神经网络模型对视频会议流量子序列进行处理而得到对应的设备安全状态信息时，可以在后续步骤中对该设备安全状态信息进行判断，以便于在确定遭到攻击或者入侵时可以执行对应的安全防护操作，从而能够提高视频会议设备的安全性。
另外，在一实施例中，参照图8，步骤S210可以包括但不限于有以下步骤：
步骤S211，对视频会议设备通讯信息进行过滤处理和裁剪处理，得到预处理信息；
步骤S212，对预处理信息进行归一化处理和独热编码处理，得到视频会议流量序列。
在一实施例中，可以对视频会议设备通讯信息进行处理而得到视频会议流量序列，以便于后续步骤中可以方便循环神经网络模型对视频会议流量序列进行处理。
在一实施例中，当视频会议设备获取到视频会议设备通讯信息后，可以对该视频会议设备通讯信息进行过滤处理和裁剪处理，以剔除该视频会议设备通讯信息中的冗余字段和固定字段(例如协议的版本信息等)，得到预处理信息，接着，对该预处理信息进行归一化处理和独热编码处理，把数据结构复杂的预处理信息转化为数据结构简单统一的特征信息，例如，将应用层协议转化为简单的协议类型和子类型，从而得到能够方便循环神经网络模型处理的视频会议流量序列。
在一实施例中，由于视频会议设备通讯信息主要由以太网帧构成，因此，在对视频会议设备通讯信息进行过滤处理、裁剪处理、归一化处理和独热编码处理的过程中，可以将每一个有效以太网帧裁剪成数据包向量，每个数据包向量对应一个视频会议流量序列中的序列时间步，该序列时间步与时间度量无关，仅表示数据包向量在视频会议流量序列中的位置关系。当对视频会议设备通讯信息进行处理而得到连续的数据包向量后，该连续的数据包向量就形成了视频会议流量序列，由于视频会议流量序列能够通过某种映射关系表达当前视频会议设备所处的安全状态，因此，通过使用循环神经网络模型对这种映射关系进行拟合建模，即可习得用视频会议流量序列识别视频会议设备的安全状态的分类器，所以，当得到视频会议流量序列后，利用循环神经网络模型对该视频会议流量序列进行相关的处理，即可得到对应的设备安全状态信息，从而可以在后续步骤中对该设备安全状态信息进行判断，以便于在确定遭到 攻击或者入侵时可以执行对应的安全防护操作，从而能够提高视频会议设备的安全性。
另外，在一实施例中，步骤S220可以包括但不限于有以下步骤：
采用滑动窗口的方式对视频会议流量序列进行采样，得到视频会议流量子序列。
在一实施例中，可以采用滑动窗口的方式对视频会议流量序列进行采样，其中，滑动窗口的长度和滑动窗口的滑动步长，均可以根据实际应用情况而进行适当的选择，本实施例对此并不作具体限定，例如，滑动窗口的长度可以选择为200，滑动窗口的滑动步长可以设定为滑动窗口的长度的一半，因此，可以形成具有200个时间步的视频会议流量子序列。如图7所示，以6个时间步的视频会议流量子序列为例，将视频会议流量子序列的数据包向量按照序列的顺序输入到循环神经网络模型中，可以得到与该视频会议流量子序列对应的设备安全状态信息的预测概率。
另外，在一实施例中，步骤S300中的执行安全防护操作，可以包括但不限于有以下步骤：
当处于视频会议接入呼叫阶段，停止接入呼叫，并向网络管理器上报告警信息。
在一实施例中，当设备安全状态信息触发了安全告警而使得视频会议设备执行安全防护操作时，如果视频会议设备处于视频会议接入呼叫阶段，可以停止视频会议设备的接入呼叫，并且还可以执行本地的病毒查杀等安全防护操作，以避免受到攻击或者入侵的视频会议设备影响整个视频会议的正常进行，此外，在视频会议设备停止接入呼叫时，视频会议设备还可以向网络管理器上报告警信息，以使网络管理器可以根据由视频会议设备上报的告警信息向整个视频会议的参与设备进行告警通知，从而可以防止视频会议中传输的信息发生泄露或被修改，达到提高视频会议设备的安全性的目的。
另外，在一实施例中，步骤S300中的执行安全防护操作，还可以包括但不限于有以下步骤：
当处于视频会议已接入阶段，挂断视频会议，或者加密视频会议中的传输数据。
在一实施例中，当设备安全状态信息触发了安全告警而使得视频会议设备执行安全防护操作时，如果视频会议设备处于视频会议已接入阶段，可以挂断当前的视频会议，避免受到攻击或者入侵的视频会议设备影响整个视频会 议的正常进行，此外，视频会议设备还可以加密视频会议中的传输数据，从而可以防止视频会议中传输的信息发生泄露或被修改，达到提高视频会议设备的安全性的目的。
另外，在一实施例中，该视频会议安全防护方法还可以包括但不限于有以下步骤：
对视频会议中的对端设备发送告警信息。
在一实施例中，当本地的视频会议设备确定遭受了攻击或者入侵的情况下，本地的视频会议设备除了执行本地的安全防护操作之外，还可以对视频会议中的对端设备发送告警信息，使得视频会议中的对端设备可以及时挂断当前的视频会议或者加密视频会议中的传输数据，从而可以防止视频会议中传输的信息发生泄露或被修改，达到提高视频会议设备的安全性的目的。
在一实施例中，确定遭受攻击或者入侵的视频会议设备和视频会议中的对端设备之间，可以建立有专门的信令通道，用以实现视频会议中各个视频会议设备之间的安全告警消息的传递，以便于视频会议中的各个视频会议设备能够及时获知是否存在视频会议设备被攻击或入侵的情况，从而能够及时执行对应的安全防护操作，防止视频会议中传输的信息发生泄露或被修改，达到提高视频会议设备的安全性的目的。值得注意的是，专门的信令通道可以采用基于SIP协议的INFO、MESSAGE或NOTIFY等方法实现，本实施例对此并不作具体限定。
另外，在一实施例中，该视频会议安全防护方法还可以包括但不限于有以下步骤：
当获取到来自视频会议中对端设备的告警信息，挂断对应的对端设备，或者加密视频会议中的传输数据。
在一实施例中，当本地的视频会议设备获取到来自视频会议中对端设备的告警信息，说明视频会议中的对端设备遭受到了攻击或者入侵，为了防止视频会议中传输的信息发生泄露或被修改，本地的视频会议设备可以挂断对应的对端设备，避免对端设备影响整个视频会议的正常进行，此外，本地的视频会议设备还可以与视频会议中的对端设备加密视频会议中的传输数据，从而可以防止视频会议中传输的信息发生泄露或被修改，达到提高视频会议设备的安全性的目的。
另外，在一实施例中，该视频会议安全防护方法还可以包括但不限于有以下步骤：
从服务器中下载预先训练好的循环神经网络模型。
在一实施例中，服务器中可以保存有预先训练好的循环神经网络模型，因此，当视频会议设备需要使用循环神经网络模型对视频会议设备通讯信息进行处理时，视频会议设备直接从服务器中下载该预先训练好的循环神经网络模型即可，不需要在本地对该循环神经网络模型进行训练，从而可以节省对循环神经网络模型进行训练的时间，提高利用循环神经网络模型得到设备安全状态信息的效率。
在一实施例中，在服务器中对循环神经网络模型进行训练时，可以采用由模拟实际攻击模型所产生的数据作为训练数据，或者采用实际工程实施中所获取到的攻击数据作为训练数据，然后，根据这些训练数据构建数据集，接着，随机打散该数据集，并且按照一定的比例(例如8:1:1)把该经过随机打散的数据集划分为训练集、测试集和验证集，然后，把训练集输入到如图5所示的循环神经网络模型中，采用迭代学习策略对循环神经网络模型进行学习，使用沿时间反向传播算法更新循环神经网络模型的权重值和偏置参数，每个训练轮次结束后，利用验证集校验所生成的循环神经网络模型，如果连续多个训练轮次的验证误差均无明显改善，则停止迭代，采用最后一次有改善的轮次的权重值和偏置参数作为训练好的循环神经网络模型的模型参数，此时，即完成了对循环神经网络模型的训练处理。值得注意的是，可以通过keras把已经训练好的循环神经网络模型保存为HDF5格式的文件，其中，keras为一个开源人工神经网络库，可以用于深度学习模型的设计、调试、评估、应用和可视化。
在一实施例中，当视频会议设备从服务器中下载预先训练好的循环神经网络模型时，视频会议设备可以通过由服务器所提供的RESTFul API接口获取循环神经网络模型的模型文件，然后将该模型文件加载为实际使用的循环神经网络模型(即分类预测模型)，从而可以在后续步骤中直接利用该循环神经网络模型得到设备安全状态信息，以便于在根据该设备安全状态信息确定遭到了攻击或者入侵时可以及时执行对应的安全防护操作，从而能够提高视频会议设备的安全性。
另外，本申请的一个实施例还提供了一种设备，该设备包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序。
处理器和存储器可以通过总线或者其他方式连接。
存储器作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序。此外，存储器可以包括高速随机存取存储 器，还可以包括非暂态存储器，例如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器可包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至该处理器。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
需要说明的是，本实施例中的设备，可以包括有如图1所示实施例中的系统架构，本实施例中的设备和如图1所示实施例中的系统架构属于相同的发明构思，因此这些实施例具有相同的实现原理以及技术效果，此处不再详述。
实现上述实施例的视频会议安全防护方法所需的非暂态软件程序以及指令存储在存储器中，当被处理器执行时，执行上述实施例中的视频会议安全防护方法，例如，执行以上描述的图2中的方法步骤S100至S300、图3中的方法步骤S210至S230、图8中的方法步骤S211至S212。
以上所描述的设备实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
此外，本申请的一个实施例还提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机可执行指令，该计算机可执行指令被一个处理器或控制器执行，例如，被上述终端实施例中的一个处理器执行，可使得上述处理器执行上述实施例中的视频会议安全防护方法，例如，执行以上描述的图2中的方法步骤S100至S300、图3中的方法步骤S210至S230、图8中的方法步骤S211至S212。
本申请实施例包括：获取视频会议设备通讯信息；利用预先训练好的循环神经网络模型对视频会议设备通讯信息进行处理，得到与视频会议设备通讯信息对应的设备安全状态信息；当设备安全状态信息触发安全告警，执行安全防护操作。根据本申请实施例提供的方案，视频会议设备通过获取视频会议设备通讯信息，并利用预先训练好的循环神经网络模型对该视频会议设备通讯信息进行处理而得到与该视频会议设备通讯信息对应的设备安全状态信息，如果该设备安全状态信息触发了安全告警，则说明该视频会议设备当前受到了攻击或者入侵，此时，该视频会议设备可以执行安全防护操作，以防止视频会议中传输的信息发生泄露或被修改，从而能够提高视频会议设备的安全性。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物 理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上是对本申请的一些实施进行了具体说明，但本申请并不局限于上述实施方式，熟悉本领域的技术人员在不违背本申请范围的前提下还可作出种种的等同变形或替换，这些等同的变形或替换均包含在本申请权利要求所限定的范围内。

Claims (10)

  1. 一种视频会议安全防护方法，包括：
    获取视频会议设备通讯信息；
    利用预先训练好的循环神经网络模型对所述视频会议设备通讯信息进行处理，得到与所述视频会议设备通讯信息对应的设备安全状态信息；
    当所述设备安全状态信息触发安全告警，执行安全防护操作。
  2. 根据权利要求1所述的方法，其中，所述利用预先训练好的循环神经网络模型对所述视频会议设备通讯信息进行处理，得到与所述视频会议设备通讯信息对应的设备安全状态信息，包括：
    将所述视频会议设备通讯信息转化成视频会议流量序列；
    对所述视频会议流量序列进行采样，得到视频会议流量子序列；
    利用预先训练好的循环神经网络模型对所述视频会议流量子序列进行处理，得到与所述视频会议流量子序列对应的设备安全状态信息。
  3. 根据权利要求2所述的方法，其中，所述将所述视频会议设备通讯信息转化成视频会议流量序列，包括：
    对所述视频会议设备通讯信息进行过滤处理和裁剪处理，得到预处理信息；
    对所述预处理信息进行归一化处理和独热编码处理，得到视频会议流量序列。
  4. 根据权利要求2所述的方法，其中，所述对所述视频会议流量序列进行采样，得到视频会议流量子序列，包括：
    采用滑动窗口的方式对所述视频会议流量序列进行采样，得到视频会议流量子序列。
  5. 根据权利要求1所述的方法，其中，所述执行安全防护操作，包括如下之一：
    当处于视频会议接入呼叫阶段，停止接入呼叫，并向网络管理器上报告警信息；
    当处于视频会议已接入阶段，挂断视频会议，或者加密视频会议中的传输数据。
  6. 根据权利要求5所述的方法，其中，所述执行安全防护操作，还包括：
    对视频会议中的对端设备发送告警信息。
  7. 根据权利要求1所述的方法，还包括：
    当获取到来自视频会议中对端设备的告警信息，挂断对应的对端设备，或者加密视频会议中的传输数据。
  8. 根据权利要求1至7任意一项所述的方法，其中，还包括：
    从服务器中下载预先训练好的所述循环神经网络模型。
  9. 一种设备，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其中，所述处理器执行所述计算机程序时实现如权利要求1至8中任意一项所述的方法。
  10. 一种计算机可读存储介质，存储有计算机可执行指令，其中，所述计算机可执行指令用于执行权利要求1至8中任意一项所述的方法。
PCT/CN2021/101544 2020-06-24 2021-06-22 视频会议安全防护方法、设备及计算机可读存储介质 WO2021259261A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010592436.X 2020-06-24
CN202010592436.XA CN113839915A (zh) 2020-06-24 2020-06-24 视频会议安全防护方法、设备及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2021259261A1 true WO2021259261A1 (zh) 2021-12-30

Family

ID=78964880

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/101544 WO2021259261A1 (zh) 2020-06-24 2021-06-22 视频会议安全防护方法、设备及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN113839915A (zh)
WO (1) WO2021259261A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106254813A (zh) * 2016-07-29 2016-12-21 微云（武汉）科技有限公司 一种实现移动视频会议的方法、视频会议服务器以及系统
CN106302329A (zh) * 2015-05-21 2017-01-04 中兴通讯股份有限公司 远程会议身份认证方法及装置
CN108574818A (zh) * 2017-08-15 2018-09-25 北京视联动力国际信息技术有限公司 一种信息显示的方法、装置和服务器
US20180322254A1 (en) * 2017-05-02 2018-11-08 James Paul Smurro Multimodal cognitive collaboration and cybernetic knowledge exchange with visual neural networking streaming augmented medical intelligence
CN109309806A (zh) * 2018-10-22 2019-02-05 视联动力信息技术股份有限公司 一种视频会议的管理方法和系统
CN110225067A (zh) * 2019-07-24 2019-09-10 上海戎磐网络科技有限公司 一种物联网安全预警系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106302329A (zh) * 2015-05-21 2017-01-04 中兴通讯股份有限公司 远程会议身份认证方法及装置
CN106254813A (zh) * 2016-07-29 2016-12-21 微云（武汉）科技有限公司 一种实现移动视频会议的方法、视频会议服务器以及系统
US20180322254A1 (en) * 2017-05-02 2018-11-08 James Paul Smurro Multimodal cognitive collaboration and cybernetic knowledge exchange with visual neural networking streaming augmented medical intelligence
CN108574818A (zh) * 2017-08-15 2018-09-25 北京视联动力国际信息技术有限公司 一种信息显示的方法、装置和服务器
CN109309806A (zh) * 2018-10-22 2019-02-05 视联动力信息技术股份有限公司 一种视频会议的管理方法和系统
CN110225067A (zh) * 2019-07-24 2019-09-10 上海戎磐网络科技有限公司 一种物联网安全预警系统

Also Published As

Publication number Publication date
CN113839915A (zh) 2021-12-24

Similar Documents

Publication Publication Date Title
US10657463B2 (en) Bot-based data collection for detecting phone solicitations
US20190132214A1 (en) Impact analyzer for a computer network
US10205637B2 (en) Impact analyzer for a computer network
US20150215365A1 (en) Dynamic management of collaboration sessions using real-time text analytics
Shahid et al. Generative deep learning for Internet of Things network traffic generation
WO2021082834A1 (zh) 报文处理方法、装置、设备及计算机可读存储介质
CN109076073B (zh) 用于阻止互联网协议语音系统中的不期望的通信的系统和方法
US11223635B2 (en) Inception of suspicious network traffic for enhanced network security
US20180159902A1 (en) Access to data on a remote device
US11930036B2 (en) Detecting attacks and quarantining malware infected devices
CN109743314A (zh) 网络异常的监控方法、装置、计算机设备及其存储介质
Prasath et al. A meta‐heuristic Bayesian network classification for intrusion detection
Verma et al. A detailed survey of denial of service for IoT and multimedia systems: Past, present and futuristic development
US10671708B2 (en) Periodicity detection of network traffic
WO2022034405A1 (en) Low-latency identification of network-device properties
WO2021259261A1 (zh) 视频会议安全防护方法、设备及计算机可读存储介质
Oujezsky et al. Botnet C&C traffic and flow lifespans using survival analysis
CN113765846A (zh) 一种网络异常行为智能检测与响应方法、装置及电子设备
Hsiao et al. Cross-level behavioral analysis for robust early intrusion detection
US11405778B2 (en) User confidentiality protection system
CN114866310A (zh) 一种恶意加密流量检测方法、终端设备及存储介质
WO2020113401A1 (zh) 数据检测方法、装置及设备
Oujezsky et al. Modeling botnet C&C traffic lifespans from NetFlow using survival analysis
EP3621265A1 (en) Method and apparatus for detecting and mitigating information security threats in the internet
Shuai et al. SIP Flood Attack Detection Method Based on Convolution Neural

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21829640

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 21/07/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21829640

Country of ref document: EP

Kind code of ref document: A1