WO2022052476A1 - 检测模型的训练方法、系统、设备及存储介质 - Google Patents

检测模型的训练方法、系统、设备及存储介质 Download PDF

Info

Publication number
WO2022052476A1
WO2022052476A1 PCT/CN2021/089390 CN2021089390W WO2022052476A1 WO 2022052476 A1 WO2022052476 A1 WO 2022052476A1 CN 2021089390 W CN2021089390 W CN 2021089390W WO 2022052476 A1 WO2022052476 A1 WO 2022052476A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet flow
gateway device
malicious
model
server
Prior art date
Application number
PCT/CN2021/089390
Other languages
English (en)
French (fr)
Inventor
焦丽娟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21865537.1A priority Critical patent/EP4203349A4/en
Publication of WO2022052476A1 publication Critical patent/WO2022052476A1/zh
Priority to US18/180,960 priority patent/US20230231871A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/098—Distributed learning, e.g. federated learning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/142—Denial of service attacks against network infrastructure

Definitions

  • the present application relates to the field of network security technology, and further relates to the application of artificial intelligence (Artificial Intelligence, AI) technology in the field of network security technology, in particular to a training method, system, device and storage medium for a detection model.
  • AI Artificial Intelligence
  • AI artificial intelligence
  • the basic principle of applying AI technology to identify malicious packet flow is that the computer uses machine learning algorithms to train malicious samples and normal samples to obtain detection models, such as convolutional neural network (CNN).
  • CNN convolutional neural network
  • the detection model can learn the characteristics of malicious packet flows through malicious samples; the detection model can learn the characteristics of normal packet flows through normal samples. Therefore, in the prediction stage, the computer can automatically distinguish whether a packet flow is a malicious packet flow or a normal packet flow through the detection model.
  • the traffic flow refers to a series of packets from a source host to a destination.
  • the destination is, for example, another host, a multicast group containing multiple hosts, or a broadcast domain.
  • Embodiments of the present application provide a method, system, device, and storage medium for training a detection model, which can improve the effect of model training, thereby helping to improve the performance of the detection model.
  • the technical solution is as follows:
  • a first aspect provides a training method for a detection model, which is described from the perspective of a gateway device participating in federated learning.
  • a first gateway device acquires at least one packet stream transmitted through the first gateway device;
  • the first gateway device obtains a malicious sample set according to the at least one packet flow, and the malicious samples included in the malicious sample set are metadata of malicious packet flows in the at least one packet flow;
  • the first The gateway device obtains the first model parameter from the first server;
  • the first gateway device performs model training according to the malicious sample set, the shared sample and the first model parameter, so as to obtain a detection model after model training, and the shared
  • the sample is a malicious sample provided by the first server to each gateway device in the gateway device set, where the gateway device set includes the first gateway device, and the detection model is used by the first gateway device for subsequent pass through Detect whether the packet flow transmitted by the first gateway device is malicious, and the detection model after the model training has the second model parameter; the first gateway device sends the second model to the first server parameter.
  • the gateway device since the gateway device not only calibrates the malicious samples by using the message flow transmitted by itself, but also receives the shared malicious samples and model parameters sent by the server, the gateway device uses the locally calibrated malicious samples and the malicious samples sent by the server. and model parameters to jointly train the model, thereby alleviating the problem of insufficient malicious samples faced by the gateway device, and driving the training of the detection model through more abundant malicious samples. Therefore, this method can improve the effect of model training, thereby helping to improve the performance of the detection model, helping to reduce the false positive rate of using the detection model to detect the packet flow, and helping to improve the attack of using the detection model to detect the packet flow coverage.
  • the at least one packet flow includes a first packet flow
  • the first gateway device obtains a malicious sample set according to the at least one packet flow, including: if the first packet flow hits blocking
  • the first gateway device determines the metadata of the first packet flow as the malicious sample, and the blocking rule is used to block the malicious packet flow.
  • the above provides a technical means for calibrating malicious samples on a gateway device. Since the gateway device obtains malicious samples from the packet flow transmitted by itself by means of blocking rules, the complexity of obtaining malicious samples is reduced, which helps to enrich the malicious samples in the malicious sample set.
  • the at least one packet flow includes a second packet flow
  • the first gateway device obtains a malicious sample set according to the at least one packet flow, including: if the second packet flow does not hit the block blocking rule, the first gateway device inputs the metadata of the second packet flow into the detection model before model training, and the blocking rule is used to block malicious packet flow, wherein when the first gateway device When the device performs the model training for the first time, the detection model before the model training is the initial detection model; if the output result of the detection model before the model training indicates that the second packet flow is a suspicious packet flow, The first gateway device analyzes the second packet flow; if it is determined through the analysis that the second packet flow is a malicious packet flow, the first gateway device analyzes the second packet flow. metadata identified as the malicious sample.
  • the above provides a technical means for calibrating malicious samples on a gateway device.
  • the gateway device uses the two methods of model and local analysis to jointly calibrate malicious samples, which improves the accuracy of malicious samples.
  • the output result of the detection model before the model training further indicates a probability value that the second packet flow is a malicious packet flow
  • the first gateway device analyzes the second packet flow include:
  • the first gateway device determines that the second packet flow is a malicious packet flow , the probability value indicates the possibility that the second packet flow is a malicious packet flow.
  • the first gateway device analyzes the second packet flow, including:
  • the first gateway device determines that the second packet flow is a malicious packet flow, and the first time period is obtained by the first gateway device
  • the time to the second packet flow is the historical time period of the end point
  • the event source included in the DGA event is the first host
  • the first host is the source host of the second packet flow, so
  • the DGA event indicates that the first host accesses the DGA domain name.
  • the first gateway device analyzes the second packet flow, including: if there is an intranet brute force cracking event generated within a second time period, the first gateway device determines the second packet flow.
  • the message flow is a malicious message flow
  • the second time period is a historical time period that ends when the first gateway device obtains the second message flow
  • the intranet brute force cracking event indicates that the occurrence of For a brute force attack targeting the intranet where the first host is located, the first host is the source host of the second packet flow; or, if there is a leakage event of sensitive information generated within the second time period
  • the first gateway device determines that the second packet flow is a malicious packet flow, and the sensitive information leakage event indicates that the sensitive information on the first host is sent to the external network; or, if There is an external network DDoS event generated within a second time period, the first gateway device determines that the second packet flow is a malicious packet flow, and the external network DDoS event indicates that the first DDoS attacks initiated by the internal network of the
  • the first gateway device analyzes the second packet flow, including: if the detection model before the model training within the third time period is for the output result presentation period of the metadata of the target packet flow property, the first gateway device determines that the second packet flow is a malicious packet flow, and the third time period is the end point when the first gateway device obtains the second packet flow
  • the target packet flow includes at least one packet flow with the first host as the source host, and the first host is the source host of the second packet flow.
  • the above provides a variety of technical means for how the gateway device can calibrate malicious samples through local analysis, which helps to solve the problem that malicious samples are difficult to obtain, and helps to collect more high-quality malicious samples.
  • the at least one packet flow includes a third packet flow
  • the first gateway device obtains a malicious sample set according to the at least one packet flow, including: if the third packet flow does not hit the block and determine that the third packet flow is not a malicious packet flow through analysis, the first gateway device sends the context information of the third packet flow to the second server, and the blocking rule is used to block block malicious packet flow, the context information includes at least one of metadata of the third packet flow or a packet capture PCAP packet of the third packet flow; the first gateway device receives the the analysis result obtained by the second server according to the context information; if the analysis result indicates that the third packet flow is a malicious packet flow, the first gateway device will send the third packet flow metadata identified as the malicious sample.
  • threat analysis is performed on the cloud to assist the gateway device in calibrating malicious samples, which reduces the complexity of calibrating malicious samples and helps to improve the accuracy of the determined malicious samples.
  • the at least one packet flow includes a third packet flow
  • the first gateway device obtains a malicious sample set according to the at least one packet flow, including: if the third packet flow does not hit the block break the rule and determine through analysis that the third packet flow is not a malicious packet flow, and the first gateway device determines according to the destination Internet Protocol IP address included in the third packet flow or the IP address included in the third packet flow source IP address, query the first threat intelligence, and the first threat intelligence includes at least one malicious IP address; if the destination IP address or the source IP address hits the malicious IP address in the first threat intelligence, the The first gateway device determines the metadata of the third packet flow as the malicious sample; or, if the third packet flow does not meet the blocking rule and determines through analysis that the third packet flow is not malicious packet flow, the first gateway device queries the second threat intelligence according to the target domain name corresponding to the third packet flow, where the target domain name is the domain name requested to be accessed by the third packet flow, and the second The threat intelligence includes at least one malicious domain name; if the third packet
  • the method further includes: the first gateway device receiving the shared sample and the detection from the first server
  • the hyperparameters of the model include the learning rate of the detection model and the initial parameters of the detection model, the learning rate is used to control the second model parameters and the model of the detection model before the model training
  • the difference between parameters, the initial parameters are used to generate the initial detection model.
  • the method further includes: acquiring, by the first gateway device, a normal sample according to the at least one packet stream set, the normal samples included in the normal sample set are the metadata of the normal packet flow in the at least one packet flow; the first gateway device according to the malicious sample set, the shared sample and the first model Performing model training on the parameters includes: the first gateway device performing model training according to the malicious sample set, the shared sample, the first model parameter and the normal sample set.
  • the method further includes: if the first normal sample When the number of occurrences in the fourth time period exceeds the first threshold, the first gateway device removes the first normal sample from the normal sample set, and the fourth time period is when the first gateway device obtains all the samples. the historical time period to which the time of the first normal sample belongs; if the number of occurrences of the first malicious sample in the fifth time period exceeds the second threshold, the first gateway device removes the first malicious sample from the malicious sample set A malicious sample, the second threshold is smaller than the first threshold, and the fifth time period is a historical time period to which the first gateway device acquires the first malicious sample.
  • the above method helps to solve the problem of unbalanced number of local malicious samples and normal samples of the gateway device, and helps to balance the local malicious samples and local normal samples of the first gateway device as much as possible. Therefore, the poor performance of the model due to the difficulty in learning the knowledge contained in a smaller number of samples is avoided, and the performance of the trained detection model is improved.
  • a method for training a detection model receives a first model parameter from a first gateway device in a gateway device set, and a parameter from a first gateway device in the gateway device set.
  • the second model parameter of the second gateway device, the first model parameter is the parameter of the first detection model, and the first detection model is used to determine whether the packet flow transmitted through the first gateway device is malicious.
  • detection the second model parameter is the parameter of the second detection model, and the second detection model is used to detect whether the packet flow transmitted through the second gateway device is malicious;
  • the first server according to The first model parameter and the second model parameter are aggregated to obtain a third model parameter; the first server sends the third model parameter to at least one gateway device in the gateway device set.
  • the server performs aggregation processing on the model parameters uploaded by each gateway device by receiving the model parameters uploaded by each gateway device, and sends the aggregated model parameters to each gateway device, so that the gateway device can use the aggregated processed model parameters.
  • the model parameters are used for model training, thereby improving the effect of the gateway device model training, thereby improving the performance of the trained detection model.
  • the first server performs aggregation processing according to the first model parameter and the second model parameter to obtain a third model parameter, including: obtaining, by the first server, the first model parameter, the The average value of the second model parameter; the first server obtains the change amount of the model parameter according to the average value and the learning rate, where the change amount is the product of the average value and the learning rate, the learning rate Used to control the difference between the model parameters of the detection model after model training and the model parameters of the detection model before model training; the first server updates the historical model parameters according to the variation, and obtains the third model parameter, the third model parameter is the difference between the historical model parameter and the change amount, and the historical model parameter is the first server after receiving the first model parameter and the first model parameter The model parameter sent to at least one gateway device in the gateway device set before the model parameter.
  • the method further includes: the first server determines a set of gateway devices participating in federated learning; the The first server sends hyperparameters and a shared sample to at least one gateway device in the gateway device set, where the shared sample is a malicious sample provided by the server to each gateway device in the gateway device set, and the hyperparameters include initial parameter and learning rate, the initial parameter is the initial parameter of the first detection model and the second detection model, and the learning rate is the learning rate of the first detection model and the second detection model.
  • the method further includes: the first server runs the malicious file in the sandbox, and obtains the result. At least one data packet captures a PCAP message; the first server generates the shared sample according to the at least one PCAP message.
  • a first gateway device is provided, and the first gateway device has a function of implementing the first aspect or any optional manner of the first aspect.
  • the first gateway device includes at least one module, and at least one module is configured to implement the training method of the detection model provided in the first aspect or any optional manner of the first aspect.
  • the modules in the first gateway device are implemented by software, and the modules in the first gateway device are program modules. In other embodiments, the modules in the first gateway device are implemented by hardware or firmware.
  • a first server is provided, where the first server has a function of implementing the second aspect or any optional manner of the second aspect.
  • the first server includes at least one module, and at least one module is configured to implement the training method of the detection model provided in the second aspect or any optional manner of the second aspect.
  • the modules in the first server are implemented by software, and the modules in the first server are program modules. In other embodiments, the modules in the first server are implemented by hardware or firmware.
  • a first gateway device in a fifth aspect, includes a network interface, a memory, and a processor connected to the memory;
  • the network interface for acquiring at least one packet stream transmitted through the first gateway device
  • the memory is used to store program instructions
  • the processor is configured to execute the program instructions, so that the first gateway device performs the following operations:
  • a malicious sample the gateway device set includes the first gateway device, and the detection model is used by the first gateway device to detect whether the packet flow subsequently transmitted through the first gateway device is malicious,
  • the detection model after the model training has second model parameters; the second model parameters are sent to the first server.
  • the at least one packet flow includes a first packet flow
  • the processor is configured to determine that the metadata of the first packet flow is the specified block if the first packet flow hits the blocking rule. the malicious sample, and the blocking rule is used to block the malicious packet flow.
  • the at least one packet flow includes a second packet flow
  • the processor is configured to input the metadata of the second packet flow into the model if the second packet flow does not meet the blocking rule
  • the detection model before training, the blocking rule is used to block malicious packet flow, wherein, when the first gateway device performs the model training for the first time, the detection model before the model training is the initial detection model; if the output result of the detection model before the model training indicates that the second packet flow is a suspicious packet flow, analyze the second packet flow; if the second packet flow is determined through the analysis
  • the message flow is a malicious message flow, and the metadata of the second message flow is determined as the malicious sample.
  • the output result of the detection model before the model training also indicates a probability value that the second packet flow is a malicious packet flow.
  • the output result indicates that the probability value that the second packet flow is a malicious packet flow is greater than the threshold, and it is determined that the second packet flow is a malicious packet flow, and the probability value indicates that the second packet flow is a malicious packet flow. Possibilities of literary flow.
  • the processor is configured to, if there is a domain name generation algorithm DGA event generated within a first time period, determine that the second packet flow is a malicious packet flow, and the first time period is based on the The time when the first gateway device obtains the second packet flow is the historical time period of the end point, the event source included in the DGA event is the first host, and the first host is the second packet flow The source host of the DGA event indicates that the first host accesses the DGA domain name.
  • the processor is configured to, if there is an intranet brute force cracking event generated within a second time period, determine that the second packet flow is a malicious packet flow, and the second time period is based on the The moment when the first gateway device obtains the second packet flow is the historical time period of the end point, and the intranet brute force cracking event indicates that a brute force cracking attack targeting the intranet where the first host is located has occurred, and the The first host is the source host of the second packet flow; or, if there is a sensitive information leakage event generated within the second time period, it is determined that the second packet flow is a malicious packet flow, and the sensitive information The leakage event indicates that the sensitive information on the first host is sent to the external network; or, if there is an external network distributed denial of service DDoS event generated within the second time period, determine the second packet The flow is a malicious packet flow, and the external network DDoS event indicates that a DDoS attack initiated by the internal network where the first host is located has occurred to the external network.
  • the processor is configured to determine that the second packet flow is malicious if the output result of the metadata of the target packet flow by the detection model before the model training in the third time period is periodic message flow, the third time period is a historical time period ending at the moment when the first gateway device acquires the second message flow, and the target message flow includes the first host as the source At least one packet flow of a host, where the first host is the source host of the second packet flow.
  • the at least one packet flow includes a third packet flow
  • the processor is configured to, if the third packet flow does not meet the blocking rule and determine through analysis that the third packet flow is not Malicious packet flow, sending the context information of the third packet flow to the second server, the blocking rule is used to block the malicious packet flow, and the context information includes the metadata of the third packet flow at least one of the data or the data packet capture PCAP message of the third message flow; receive the analysis result obtained from the second server according to the context information; if the analysis result indicates that the first The third packet flow is a malicious packet flow, and the metadata of the third packet flow is determined as the malicious sample.
  • the at least one packet flow includes a third packet flow
  • the processor is configured to, if the third packet flow does not meet the blocking rule and determine through analysis that the third packet flow is not Malicious packet flow, query the first threat information according to the destination Internet Protocol IP address included in the third packet flow or the source IP address included in the third packet flow, where the first threat information includes at least one malicious message.
  • the third packet flow misses the blocking rule and it is determined through analysis that the third packet flow is not a malicious packet flow, and the second threat information is queried according to the target domain name corresponding to the third packet flow, and the target The domain name is the domain name requested to be accessed by the third packet flow, and the second threat information includes at least one malicious domain name; if the target domain name hits the malicious domain name in the second threat information, the third packet
  • the metadata of the flow is determined to be the malicious sample; or, if the third packet flow does not meet the blocking rule and it is determined through analysis that the third packet flow is not a malicious packet flow, according to the third packet flow
  • the file identifier corresponding to the stream is queried for the third threat information, the file identifier is used to identify the file included in the third packet stream, and the third threat information includes at least one malicious file identifier;
  • the malicious file identifier corresponding to the stream is queried for the third threat information, the file identifier is used to identify the file included in the third packet stream, and
  • the network interface is configured to receive the shared samples from the first server and hyperparameters of the detection model, where the hyperparameters include the learning rate of the detection model and the detection model
  • the learning rate is used to control the difference between the second model parameter and the model parameter of the detection model before the model training, and the initial parameter is used to generate the initial detection model.
  • the processor is further configured to obtain a normal sample set according to the at least one packet flow, where the normal samples included in the normal sample set are elements of the normal packet flow in the at least one packet flow. data; perform model training according to the malicious sample set, the shared sample, the first model parameter and the normal sample set.
  • the processor is further configured to remove the first normal sample from the normal sample set if the number of occurrences of the first normal sample in the fourth time period exceeds a first threshold, and the fourth time period
  • the segment is the historical time period to which the first gateway device acquires the first normal sample; if the number of occurrences of the first malicious sample in the fifth time period exceeds the second threshold, the malicious sample collection will be retrieved from the malicious sample set.
  • the first malicious sample is removed in the middle, the second threshold is less than the first threshold, and the fifth time period is a historical time period to which the first gateway device acquires the first malicious sample.
  • a first server in a sixth aspect, includes a network interface, a memory, and a processor connected to the memory,
  • the network interface for receiving first model parameters from a first gateway device in the gateway device set, and second model parameters from a second gateway device in the gateway device set, the first model
  • the parameter is a parameter of a first detection model, and the first detection model is used to detect whether the packet flow transmitted through the first gateway device is malicious, and the second model parameter is a parameter of the second detection model , the second detection model is used to detect whether the packet flow transmitted through the second gateway device is malicious;
  • the memory is used to store program instructions
  • the processor is configured to execute the program instructions to cause the first server to perform the following operations:
  • the third model parameter is sent to at least one gateway device in the set of gateway devices.
  • the processor is configured to obtain the average value of the first model parameter and the second model parameter; according to the average value and the learning rate, obtain the variation of the model parameter, where the variation is The product of the average value and the learning rate, the learning rate is used to control the difference between the model parameters of the detection model after model training and the model parameters of the detection model before model training;
  • the historical model parameter is updated to obtain the third model parameter, the third model parameter is the difference between the historical model parameter and the change amount, and the historical model parameter is the first server receiving Model parameters sent to at least one gateway device in the set of gateway devices before the first model parameter and the second model parameter.
  • the processor is further configured to determine a set of gateway devices participating in federated learning; send hyperparameters and a shared sample to at least one gateway device in the set of gateway devices, and the shared sample is provided to the server by the server.
  • Malicious samples of each gateway device in the gateway device set, the hyperparameters include initial parameters and a learning rate, the initial parameters are the initial parameters of the first detection model and the second detection model, and the learning rate is Learning rates of the first detection model and the second detection model.
  • the processor is configured to run the malicious file in the sandbox to obtain at least one data packet capture PCAP message; and generate the shared sample according to the at least one PCAP message.
  • a computer-readable storage medium where at least one instruction is stored in the storage medium, and the instruction is read by a processor to cause the first gateway device to execute the first aspect or any one of the first aspects.
  • the training method of the detection model provided by the selection method.
  • a computer-readable storage medium where at least one instruction is stored in the storage medium, and the instruction is read by a processor to cause the first server to execute the second aspect or any one of the optional second aspects.
  • the training method of the detection model provided by the method.
  • a computer program product comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the first gateway device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the first gateway device executes the first aspect or any optional manner of the first aspect.
  • the training method of the detection model is provided, the computer program product comprising computer instructions stored in a computer-readable storage medium.
  • a computer program product comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the first server reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the first server executes the detection model provided in the second aspect or any optional manner of the second aspect training method.
  • a chip is provided.
  • the first gateway device is made to perform the training of the detection model provided in the first aspect or any optional manner of the first aspect. method.
  • a twelfth aspect provides a chip that, when the chip runs on a first server, enables the first server to execute the detection model training method provided in the second aspect or any optional manner of the second aspect.
  • a thirteenth aspect provides a system, where the system includes a first gateway device and a first server, where the first gateway device is configured to execute the method described in the first aspect or any optional manner of the first aspect, The first server is configured to execute the method described in the second aspect or any optional manner of the second aspect.
  • the system further includes a second server, and the second server is configured to receive the context information of the third packet flow from the gateway device, perform analysis according to the context information, obtain an analysis result, and send it to the gateway device.
  • the gateway device sends the analysis result, the context information includes at least one item of metadata of the third packet flow or a packet capture PCAP packet of the third packet flow, and the analysis result It is used to indicate whether the third packet flow is a malicious packet flow.
  • FIG. 1 is a schematic diagram of a system architecture 100 provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a device 200 provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a CNN model provided in an embodiment of the present application in a model training stage and a model application stage;
  • FIG. 4 is a schematic diagram of a system architecture based on a federated learning training detection model provided by an embodiment of the present application
  • FIG. 5 is a flowchart of a training method for a detection model provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an accuracy rate during training a detection model provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of local analysis of a gateway device provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a cloud analysis provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of a method for training a detection model provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of a gateway device applying a CNN model to detect a packet flow according to an embodiment of the present application
  • FIG. 12 is a schematic structural diagram of a gateway device provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a server provided by an embodiment of the present application.
  • the method provided by the embodiment of the present application can be applied to the scenario of detecting packet flow based on AI in the field of network security. Specifically, the method of the embodiment of the present application can be applied to a scenario in which a firewall uses a detection model to detect whether a packet flow is a malicious packet flow. The following is a brief introduction to the scenario of detecting malicious packet flows.
  • Malicious packet flow refers to the malicious packet flow transmitted in the network. Malicious packet flows are usually generated by various viruses, malicious crawlers, automata, and simulators. Malicious packet flows can trigger network attacks, service attacks, and malicious crawlers.
  • a malicious packet flow is a hypertext transfer protocol (HTTP) packet flow used to trigger command and control (C&C) attacks.
  • HTTP hypertext transfer protocol
  • C&C command and control
  • the HTTP packet flow that triggers the C&C attack is referred to as the C&C packet flow for short.
  • C&C attack is an important stage in advanced persistent threat (advanced persistent threat, APT). Therefore, the detection of malicious packet flow is a crucial link in security threat detection.
  • NGFW next generation firewall
  • probes etc.
  • NGFW next generation firewall
  • the data of the packet flow generated by the normal business of the industry and the data of the malicious packet flow are all stored on the gateway device. This leads to the formation of data silos, which cannot be aggregated globally to generate AI models. Therefore, how to combine data from all parties to generate AI models and deploy them in the customer environment to accurately discover more threats under the condition of meeting data privacy, security, and regulatory requirements is a problem that needs to be considered.
  • the first idea is to obtain samples through service purchase or open source download. For example, by purchasing virustotal (a free virus, worm, Trojan and various malware analysis service, referred to as VT) to obtain malicious samples and normal samples.
  • virustotal a free virus, worm, Trojan and various malware analysis service, referred to as VT
  • VT virustotal
  • problems with purchasing samples through a service there are three problems with purchasing samples through a service.
  • Problem 1 The general malicious samples and normal samples are not balanced. For example, the number of malicious samples is large, and the number of normal samples such as industry application samples is small.
  • the second idea is to obtain samples by exchanging with friendly manufacturers.
  • the problem with the second idea is that the price of purchasing samples is relatively expensive, and the quality of exchange samples cannot generally be guaranteed.
  • the third idea is to obtain malicious samples on the live network through cloud services.
  • the problem with the third idea is that the number of malicious samples that can be obtained is very limited.
  • normal samples cannot be obtained.
  • the gateway device is used as a federated learning participant to deploy a federated learning server in the cloud, the gateway device performs model training locally, and the federated learning server in the cloud aggregates model parameters, so as to solve the problem of data Island problem.
  • improvements are made to how the gateway device determines malicious samples and how to solve the problem of unbalanced number of malicious samples and normal samples faced by federated learning.
  • System architecture 100 is an example of a system architecture for training detection models based on a federated learning architecture.
  • the system architecture 100 mainly includes two types of nodes.
  • One type of node is multiple gateway devices participating in federated learning, and the other type of node is a public cloud.
  • the system architecture 100 includes a gateway device 110 participating in federated learning, a gateway device 111 participating in federated learning, a gateway device 112 participating in federated learning, and a public cloud 120 .
  • the gateway device 110, the gateway device 111, and the gateway device 112 are respectively connected to the public cloud 120 through a wireless network or a wired network.
  • Gateway device 110 gateway device 111 and gateway device 112 are examples of multiple gateway devices participating in federated learning.
  • the devices participating in federated learning also Including routers, firewall devices, etc.
  • the following describes the multiple gateway devices participating in federated learning and the public cloud 120 respectively.
  • the gateway device is used for threat detection on the packet flow transmitted in the network and acts as a participant in federated learning.
  • the gateway device can also be replaced with any one of a firewall, an intrusion detection system (intrusion detection system, IDS) type device, an intrusion prevention system (intrusion prevention system, IPS) type device, a server, a host, or a personal computer equipment.
  • IDS intrusion detection system
  • IPS intrusion prevention system
  • the gateway device 110 takes the gateway device 110 as an example to illustrate an example of one gateway device among multiple gateway devices participating in federated learning.
  • the gateway device 110 is deployed between the enterprise network 140 and the Internet.
  • the enterprise network 140 includes, for example, a switch 1401 , a personal computer 1402 , a host 1403 and other devices.
  • the gateway device 110 is connected to a switch 1401 , and the switch 1401 is connected to a personal computer 1402 and a host 1403 .
  • the switch 1401 is used for forwarding data transmitted between the personal computer 1402 , the host 1403 and other devices and the gateway device 110 .
  • the gateway device 110 will exchange various information with the public cloud 120 .
  • the information that the gateway device 110 interacts with the public cloud 120 includes model parameters, shared samples, and the like.
  • the gateway device obtains the detection model 1101 by performing model training using the information interacted with the public cloud 120 .
  • the gateway device 110 can detect whether the packet flow transmitted through the gateway device 110 is malicious. For example, when the gateway device 110 receives the packet flow transmitted between the enterprise network 140 and the Internet, the gateway device 110 can use the detection model 1101 to detect whether the packet flow transmitted between the enterprise network 140 and the Internet is malicious, Thus, threat detection is performed for the enterprise network 140 and security protection is performed for the enterprise network 140 .
  • the gateway device 111 is trained to obtain the detection model 1111 by interacting with the public cloud 120 ; the gateway device 112 is trained to obtain the detection model 1121 by interacting with the public cloud 120 .
  • different gateway devices participating in federated learning are respectively deployed between enterprise networks of different industries and the Internet, so that different gateway devices can use data from different industries as samples to participate in model training.
  • the gateway device 110 is deployed between the enterprise network of the financial industry or the securities industry and the Internet; alternatively, the gateway device 111 is deployed between the enterprise network of the energy industry and the Internet; the gateway device 112 is deployed between the government network and the Internet; Some gateway devices are deployed between the enterprise network and the Internet in the IoT industry.
  • the public cloud 120 includes an attack knowledge base production system 1201 and a federated learning server 1202 .
  • the attack knowledge base production system 1201 and the federated learning server 1202 are connected through a wireless network or a wired network.
  • the attack knowledge base production system 1201 is used to simulate, collect and manage malicious samples under various attack scenarios.
  • the attack knowledge base production system 1201 is, for example, any of a server, a host computer, or a personal computer.
  • the attack knowledge base production system 1201 includes an open source purchase module, a sandbox cultivation module, and an attack simulation module.
  • the open source purchase module is used to support the gateway device to purchase open source malicious samples.
  • the sandbox breeding module is used to support the gateway device to generate malicious samples through the sandbox.
  • the attack simulation module is used to support the gateway device to generate malicious samples by simulating network attacks.
  • the federated learning server 1202 is used to manage each participant of federated learning (ie each gateway device), organize each gateway device to perform model training, and deliver model parameters and shared malicious samples to each participant of federated learning.
  • the device 200 shown in FIG. 2 is an example of the gateway device participating in federated learning and the hardware structure of the public cloud in the above system architecture.
  • the device 200 is configured as the gateway device 110 , the gateway device 111 or the gateway device 112 .
  • the device 200 is configured as a federated learning server 1202 or an attack knowledge base production system 120 .
  • the device 200 is, for example, a host, a server, a personal computer, or the like.
  • Device 200 is optionally implemented by a general bus architecture.
  • Device 200 includes at least one processor 201 , communication bus 202 , memory 203 and at least one network interface 204 .
  • the processor 201 is, for example, a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a graphics processor (Graphics Processing Unit, GPU), a neural-network processing unit (neural-network processing units, NPU) ), a data processing unit (Data Processing Unit, DPU), a microprocessor or one or more integrated circuits for implementing the solution of the present application.
  • the processor 201 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the communication bus 202 is used to transfer information between the aforementioned components.
  • the communication bus 202 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 2, but it does not mean that there is only one bus or one type of bus.
  • the memory 203 is, for example, a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) or a memory device that can store information and instructions.
  • Other types of dynamic storage devices such as electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of Any other medium accessed by a computer without limitation.
  • the memory 203 exists independently, for example, and is connected to the processor 201 through the communication bus 202 .
  • the memory 203 may also be integrated with the processor 201 .
  • the memory 203 is used to save the detection model obtained by the device 200 performing model training.
  • the processor accesses the memory 203 to obtain the detection model saved in the memory 203 .
  • the network interface 204 uses any transceiver-like device for communicating with other devices or communication networks.
  • the network interface 204 includes a wired network interface and may also include a wireless network interface.
  • the wired network interface may be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface or a combination thereof.
  • the wireless network interface may be a wireless local area network (wireless local area networks, WLAN) interface, a cellular network network interface or a combination thereof, and the like.
  • the processor 201 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 2 .
  • the device 200 may include multiple processors, such as the processor 201 and the processor 205 shown in FIG. 2 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the device 200 may further include an output device and an input device.
  • the output device communicates with the processor 201 and can display information in a variety of ways.
  • the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, a projector, or the like.
  • the input device communicates with the processor 201 and can receive user input in a variety of ways.
  • the input device may be a mouse, a keyboard, a touch screen device, or a sensing device, or the like.
  • the memory 203 is used to store the program code 210 for executing the solutions of the present application, and the processor 201 can execute the program code 210 stored in the memory 203 . That is, the device 200 can implement the training method of the detection model provided by the method embodiment through the processor 201 and the program code 210 in the memory 203 .
  • the device 200 in this embodiment of the present application may correspond to the first gateway device, the first server, or the second server in the method embodiment, and the processor 201, the network interface 204, etc. in the device 200 may implement the previous method embodiment
  • details are not repeated here.
  • the system architecture and the hardware structure of the device in the system architecture have been described above, and the detection model provided by this embodiment is introduced below.
  • the detection model introduced below is obtained, for example, by the above-mentioned system architecture and the equipment in the above-mentioned system architecture.
  • the detection model is used to detect whether the packet flow is malicious.
  • the detection model is applied in a scenario where a gateway device detects a packet flow transmitted by itself.
  • the detection model is, for example, an AI model trained by a machine learning algorithm.
  • the detection model is an AI model trained by a supervised learning algorithm.
  • the detection model is a convolutional neural network (CNN) model or a random forest model.
  • the detection model is an AI model trained by an unsupervised learning algorithm.
  • the detection model is an auto encoder (AE) or an isolation forest model.
  • the input parameters of the detection model include the metadata of the packet flow.
  • the metadata of the packet flow includes the source IP address, destination IP address, source port number, destination port number, HTTP Uniform Resource Locator (URL), and user agent (UA) string of the packet flow , at least one of time of occurrence or duration.
  • the detection model is a CNN model
  • the input parameters of the CNN model include HTTP metadata in the message stream.
  • HTTP metadata such as the HTTP URL of the message stream and the user agent string.
  • the output of the detection model is used to indicate whether the packet flow is malicious.
  • the output of the detection model includes the type of packet flow.
  • the type of packet flow includes malicious packet flow or normal packet flow. For example, after inputting the metadata of the packet flow into the detection model, if the detection model outputs 1, it indicates that the packet flow is a malicious packet flow. After inputting the metadata of the packet flow into the detection model, if the detection model outputs 0, it indicates that the packet flow is a normal packet flow.
  • the output result of the detection model includes a risk value or a probability value that the packet flow is a malicious packet flow.
  • the risk value is used to express the correlation between packet flow and maliciousness. For example, the higher the risk value, the higher the malicious risk of the packet flow; or the lower the risk value, the higher the malicious risk of the packet flow.
  • the probability value indicates the possibility that the packet flow is a malicious packet flow.
  • the detection model also has hyperparameters.
  • the hyperparameters of the detection model include the learning rate of the detection model and the initial parameters of the detection model.
  • the learning rate of the detection model is used to control the difference of the model parameters of the detection model between two adjacent iterations.
  • the smaller the learning rate the slower the change of the loss function, and the larger the difference between the model parameters of the detection model between two adjacent iterations.
  • the learning rate is used to control the difference between the second model parameters and the model parameters of the detection model prior to model training.
  • the initial parameters of the detection model are, for example, model parameters that the detection model has before model training.
  • the detection model is a CNN model including a convolution kernel
  • the initial parameters are the initial weights of the convolution kernel in the CNN model.
  • the initial parameters will be continuously updated with the continuous iteration of training, so as to gradually approach the optimal value.
  • the detection model provided by this embodiment has been described above, and the methods involved in the detection model are introduced from the model training side and the model application side.
  • the training method of the detection model and the method of applying the detection model to detect the message flow described below are inventions based on the same idea, or understood as two parts in a system, or as two stages of an overall process: such as Model training phase and model application phase.
  • the training method for the detection model provided by the embodiment of the present application performs symbolic and formalized intelligent information modeling, extraction, preprocessing, training, etc. on the training data (such as malicious samples and normal samples in the present application), and finally
  • the trained detection model is obtained;
  • the method of applying the detection model to detect the message flow provided by the embodiment of the present application uses the trained detection model to input the input data (such as the metadata of the message flow in the present application) into the trained detection model.
  • the output data (such as the type of packet flow or the probability that the packet flow is a malicious packet flow) are obtained.
  • FIG. 3 is an illustration of the main processes involved in the CNN model in the model training phase and the model application phase.
  • This CNN model is an example of a detection model. This CNN model is used to detect C&C message flow.
  • the model training phase of the CNN model the key fields of the HTTP protocol in the malicious sample are extracted, and the extracted data is used for model training to obtain the CNN model.
  • the model application stage of the CNN model the key fields of the HTTP protocol in the current network data are extracted, and the extracted data is used to input the trained CNN model to obtain the output data.
  • the method on the model training side is implemented using a federated learning (federated learning, FL) technology.
  • federated learning federated learning, FL
  • the concept of federated learning technology is introduced below.
  • Federated learning is an emerging artificial intelligence technology in recent years. Federated learning is mainly used to solve the problem of data silos when AI algorithms are implemented in industry.
  • the so-called data island problem means that when AI algorithms are applied in industry, they often face problems such as insufficient high-quality samples, inability to share samples from data sources, and data privacy protection, resulting in AI being unable to efficiently and accurately jointly use their respective samples.
  • federated learning technology has been proposed in the industry to solve the problem of data silos.
  • Federated learning is a method of distributed training. Each participant of federated learning will train their own models with the help of other parties' data (such as model parameters). The participants of federated learning do not need to share data resources during the training process, so the joint modeling and benefit sharing of the federated learning participants can be realized without the samples being local.
  • the embodiment of the present application applies federated learning in the field of network security technology.
  • federated learning to train the detection model, the data of each gateway device can be integrated together with model training without the samples being local to the gateway device, so as to ensure the data of the gateway device.
  • model training is improved.
  • system 400 shown in FIG. 4 is an example of a system architecture for training a detection model based on federated learning.
  • System 400 is implemented, for example, by system 100 .
  • System 400 includes a server and n gateway devices. n represents a positive integer.
  • the server in system 400 is, for example, federated learning server 1202 in system 100 .
  • gateway devices in the system 400 are respectively gateway device 1, gateway device 2, gateway device 3...gateway device n shown in FIG. 4 .
  • Gateway device 1 , gateway device 2 , gateway device 3 . . . gateway device n are, for example, gateway device 111 , gateway device 112 , gateway device 113 , and gateway device 114 shown in FIG. 1 .
  • the gateway device acts as a participant in federated learning.
  • the gateway device is mainly responsible for the calibration of malicious samples and model training based on local malicious samples.
  • Sample calibration generally refers to the process of adding labels to samples.
  • the label indicates the type of sample.
  • the types of samples are divided into malicious samples and normal samples.
  • the calibration of a malicious sample is, for example, determining the metadata of a packet flow as a malicious sample.
  • the calibration of malicious samples includes detecting whether a packet flow is a malicious packet flow or a normal packet flow.
  • the samples that the gateway device is responsible for calibrating, for example, come from the packet flow transmitted by the gateway device itself. For example, gateway device 1 collects sample 1 from the packet flow transmitted by gateway device 1 .
  • the gateway device 1 saves the sample 1 locally in the gateway device 1 .
  • gateway device 1 uses sample 1 to participate in model training.
  • the gateway device 2 collects the sample 2 from the packet flow transmitted by the gateway device 2 .
  • the gateway device 2 saves the sample 2 locally in the gateway device 2 .
  • gateway device 2 uses sample 2 to participate in model training.
  • n gateway devices respectively obtain local samples according to the message flow transmitted by themselves; n gateway devices respectively use local samples to participate in model training.
  • the server acts as a scheduler for federated learning.
  • the server is mainly responsible for aggregating model parameters on each gateway device, delivering various data to each gateway device, and selecting which gateway devices participate in federated learning.
  • model training includes an initialization phase and n iterations.
  • the model training sequence is initialization stage ⁇ 1st iteration ⁇ 2nd iteration ⁇ ...tth iteration... ⁇ nth iteration.
  • t represents the index of the current iteration, and t is a positive integer greater than or equal to 1 and less than or equal to n.
  • the server selects which gateway devices participate in federated learning. After the server selects the gateway device participating in federated learning, the server will send the hyperparameters of the detection model (such as learning rate, initial weight) and shared samples to each selected gateway device, so that the hyperparameters of the detection model and the shared samples are synchronized to the Each gateway device participating in federated learning.
  • the hyperparameters of the detection model such as learning rate, initial weight
  • each gateway device participating in federated learning will perform model training based on the hyperparameters, shared samples, local malicious samples, and local normal samples delivered by the server, and obtain the model parameters of the first iteration.
  • Each gateway device will upload the obtained model parameters of the first iteration to the server respectively.
  • the server aggregates the model parameters of the first iteration of each gateway device, and sends the aggregated model parameters to each gateway device, so that the aggregated model parameters are synchronized to each gateway device.
  • the shared samples are generated, for example, by the server through the sandbox before the initialization phase.
  • each gateway device participating in federated learning will perform model training based on the aggregated model parameters, shared samples, local malicious samples and local normal samples delivered by the server, and obtain the model of the second iteration. parameter.
  • Each gateway device will upload the obtained model parameters of the second iteration to the server respectively.
  • the server aggregates the model parameters of the second iteration of each gateway device, and sends the aggregated model parameters to each gateway device, so that the aggregated model parameters are synchronized to each gateway device. .
  • the server After performing n iterations, when the server determines that the loss function converges or the accuracy of the detection model reaches the accuracy threshold, the server stops the model training process. At this point, the model training process ends, and the model parameters obtained by each gateway device in this iteration are the parameters after the detection model training.
  • each gateway device uploads the model parameters to the server in each iteration, and the server aggregates the model parameters on each gateway device, and sends the aggregated model parameters to each gateway In the next iteration, each gateway device uses the aggregated model parameters for model training, so that the data used in the model training of each gateway device is better, thereby improving the effect of model training.
  • the technical principles to achieve the technical effect of improving model training are analyzed in detail.
  • the model training can only use the data on one gateway device alone. Due to insufficient data used for model training, it will seriously affect the effect of the model.
  • the model parameters uploaded by each gateway device can respectively reflect the information contained in the samples on each gateway device (such as each gateway device). characteristics of the packet flow transmitted by the gateway device itself). Therefore, after the model parameters uploaded by each gateway device are aggregated, the aggregated model parameters can comprehensively reflect the information contained in the samples on each gateway device, which is richer than the model parameters learned locally by a single gateway device.
  • each gateway device performs model training by using the aggregated model parameters, which is equivalent to that each gateway device uses data on other gateway devices to train its own detection model.
  • the effect achieved is similar to that of gateway device 1 using data from gateway device 2, gateway device 3, ... gateway device n and other gateway devices participating in federated learning to train and detect together.
  • Model Since the model training uses more data, it can obviously improve the effect of the model.
  • this embodiment does not limit whether the data exchanged between the gateway device and the server only passes through the gateway device and the server, or passes through the gateway device and other devices other than the server.
  • one or more network devices are further deployed between the gateway device and the server, and data exchanged between the gateway device and the server is forwarded through one or more network devices.
  • the data exchanged between the gateway device and the server may take the path of server ⁇ gateway device, or server ⁇ one or more network devices ⁇ gateway device.
  • the data exchange between the gateway device and the server is There is no restriction on how to transmit data.
  • the above describes the overall concept of training a detection model based on federated learning.
  • the following is an example of how to train a detection model based on federated learning.
  • Method 500 is an illustration of a method performed by a gateway device participating in federated learning.
  • Method 600 is an illustration of a method performed by a server participating in federated learning.
  • Both the first gateway device and the second gateway device in the method 500 and the method 600 refer to one gateway device participating in federated learning.
  • the first gateway device is the gateway device 110 in the system architecture 100 shown in FIG. 1
  • the second gateway device is the gateway device 111 in the system architecture 100 shown in FIG. 1 .
  • the first gateway device is one of gateway device 1, gateway device 2, gateway device 3...gateway device n in the system architecture 400 shown in FIG. 4, and the second gateway device is the system architecture 400 shown in FIG. 4
  • the gateway device 1, the gateway device 2, the gateway device 3...the gateway device n is another gateway device except the first gateway device.
  • the first server in method 500 and method 600 refers to a server participating in federated learning.
  • the first server is the federated learning server 1202 in the system architecture 100 shown in FIG. 1 .
  • the first server is the server in the system architecture 400 shown in FIG. 4 .
  • method 500 and method 600 are processed by a general-purpose central processing unit (CPU).
  • CPU central processing unit
  • method 500 and method 600 are jointly processed by the CPU and one or more AI accelerator cards.
  • the CPU and the AI accelerator card are used to undertake the processing work corresponding to the different steps of the method 500 and the method 600 .
  • the AI accelerator card undertakes the processing work corresponding to the model training in method 500 and method 600 .
  • the CPU undertakes the processing work corresponding to the malicious sample obtained in the method 500 and the method 600 .
  • the AI accelerator card is, for example, a graphics processor (graphics processing unit, GPU), an embedded neural network processor (neural-network processing units, NPU), a tensor processing unit (tensor processing unit, TPU) or other machine learning And custom chips.
  • a graphics processor graphics processing unit, GPU
  • an embedded neural network processor neural-network processing units, NPU
  • a tensor processing unit tensor processing unit, TPU
  • TPU tensor processing unit
  • the second server in the method 500 is, for example, the enterprise private cloud 130 in the system architecture shown in FIG. 7 .
  • the second server in the method 500 is located in the same enterprise network as the first gateway device, for example.
  • the malicious samples and normal samples in the method 500 and the method 600 are, for example, data maintained locally by the gateway device.
  • the malicious samples and the normal samples in the method 500 are data stored in the database 1104 shown in FIG. 7 .
  • the shared samples in method 500 and method 600 are, for example, server-generated data.
  • the shared samples in the methods 500 and 600 are data generated by the attack knowledge base production system 1201 shown in FIG. 1 or FIG. 7 .
  • the multiple detection models in the method 500 and the method 600 are described as an example of a CNN model for detecting the C&C message flow. It should be noted that this embodiment does not limit the specific type of the detection model.
  • the method performed in the case where the detection model is another type of AI model is the same as that of method 500 and method 600 .
  • the malicious packet flow is the C&C packet flow and the malicious sample is the metadata of the C&C packet flow as examples for description. It should be noted that this embodiment does not limit the specific types of malicious packet flows and malicious samples. In other words, it is not limited that the gateway device uses the metadata of the packet flow that triggers the network attack to perform model training, nor is it limited to use the detection model to detect which type of malicious packet flow.
  • the first gateway device, the second gateway device, the first server, and the second server in the method 500 and the method 600 are implemented by the device 200 shown in FIG. 2 .
  • Various steps performed by the first gateway device, the second gateway device, the first server or the second server in the method 500 and the method 600 are implemented by various hardwares in the device 200 .
  • the steps of the method 500 and the method 600 are accomplished by hardware integrated logic circuits in the processor 201 of the device 200 or instructions in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules are located in, for example, random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory 210, and the processor 201 reads the information in the memory 210, and completes the steps of the method 500 and the method 600 in combination with its hardware.
  • FIG. 5 is a flowchart of method 500 .
  • the method 500 includes S510 to S570.
  • the first gateway device acquires at least one packet flow transmitted through the first gateway device.
  • the first gateway device acquires the packet flow includes various manners. For example, the first gateway device is deployed at the egress of the intranet, and the first gateway device receives packet streams transmitted between different hosts in the intranet; or, the first gateway device receives packets transmitted between the intranet and the extranet flow. For example, when a host on the intranet initiates access to an external network device, the host on the intranet generates and sends a packet stream; the packet stream is transmitted to the first gateway device through the network; the first gateway device receives the packet stream. For another example, when the external network device transmits data to the host of the internal network, the external network device generates and sends a packet stream; the packet stream is transmitted to the first gateway device through the network; the first gateway device receives the packet stream.
  • the first gateway device After obtaining the packet flow, the first gateway device will demarcate the attack sample and the normal sample according to the obtained packet flow. Step S520 is used below to illustrate how to calibrate the attack sample and the normal sample.
  • the first gateway device acquires a malicious sample set and a normal sample set according to at least one packet flow.
  • a sample is the data used to train the detection model.
  • the sample is metadata of the packet flow.
  • a sample is metadata for a packet flow.
  • the metadata of the packet flow is the data used to describe the packet flow.
  • the types of samples are classified into malicious samples and normal samples.
  • Malicious samples are metadata of malicious packet flows.
  • a malicious sample is the metadata of a malicious packet flow.
  • Malicious samples are also called black samples or attack samples.
  • the malicious sample set includes at least one malicious sample.
  • Normal samples are metadata of normal packet flows.
  • a normal sample is the metadata of a normal packet flow. Normal samples are also called white samples.
  • the normal sample set includes at least one normal sample.
  • the first gateway device obtains the malicious sample set and the normal sample set includes various ways. For example, the first gateway device identifies at least one malicious packet flow and at least one normal packet flow in at least one packet flow; the first gateway device obtains metadata of each malicious packet flow in the at least one malicious packet flow, The first gateway device uses the metadata of each malicious packet flow as a malicious sample, thereby obtaining a malicious sample set; the first gateway device obtains the metadata of each normal packet flow in at least one normal packet flow, and the first gateway device obtains the metadata of each normal packet flow in the at least one normal packet flow. The device takes the metadata of each normal packet flow as a normal sample to obtain a normal sample set.
  • the following S530 is also performed.
  • the following S530 is not performed, and S540 is performed.
  • the first gateway device filters the normal sample set and the malicious sample set.
  • the first gateway device screens the normal sample set and the malicious sample set respectively, so as to use the filtered samples for model training.
  • the problem of unbalanced number of local malicious samples and normal samples of the gateway device can be solved, and the local malicious samples and local normal samples of the first gateway device can be balanced as much as possible. Therefore, the poor performance of the model due to the difficulty in learning the knowledge contained in a smaller number of samples is avoided, and the performance of the trained detection model is improved.
  • the balance between malicious samples and normal samples means that the magnitude difference between malicious samples and normal samples is not large.
  • the ratio between the number of malicious samples and the number of normal samples is not less than a ratio threshold, which is, for example, 1:100.
  • a ratio threshold which is, for example, 1:100.
  • the selection of samples is determined according to the quantitative relationship between the number of occurrences of the samples in the historical time period and the threshold.
  • the first gateway device removes the samples whose occurrence times exceed the threshold in the historical time period, and retains the samples whose occurrence times do not exceed the threshold in the historical time period, thereby realizing the screening of samples.
  • the unit of the historical time period includes, but is not limited to, days, weeks, hours, and the like. For example, a historical time period is one or more days.
  • the threshold used for screening the normal sample set is larger than the threshold used to filter the malicious sample set. Considering that there are often few malicious samples and many normal samples on the existing network, this technical means can reduce the number of normal samples and increase the number of normal samples due to the large threshold used for screening the normal sample set and the small threshold used when screening the malicious sample set. The number of malicious samples to meet the needs of sample balance.
  • the threshold used for screening the normal sample set and the threshold used for screening the malicious sample set are also determined according to the memory capacity of the gateway device.
  • the smaller the memory capacity of the gateway device the lower the threshold used for screening normal sample sets and the threshold used when screening malicious sample sets, thereby reducing the number of samples stored by the gateway device and avoiding excessive samples occupying the limited memory space of the gateway device .
  • the first gateway device establishes separate tables for malicious samples and normal samples. After obtaining the malicious samples and the normal samples, the first gateway device stores the malicious samples and the normal samples in corresponding tables respectively. The first gateway device filters the normal sample set and the malicious sample set by looking up the table. Among them, the table adopts the index structure of key value. The key of the table is the metadata of the message flow. The value of the table is the number of occurrences of the sample in the historical time period. The first gateway device filters the normal sample set and the malicious sample set by looking up the table. Tables are for example stored in a database.
  • gateway devices build tables by date when storing HTTP C&C malicious samples.
  • the keys of the table are the HTTP URL and user agent string of the message stream.
  • the value of the table is the number of occurrences of HTTP C&C malicious samples on that day.
  • the gateway device builds up to 30 tables for HTTP C&C malicious samples. 30 tables are used to save the data of the HTTP C&C malicious samples in the last 30 days.
  • the gateway device establishes the table black_http_cc_2020_05_01.
  • the table black_http_cc_2020_05_01 represents the data for the HTTP C&C malicious sample on May 1.
  • the keys of table black_http_cc_2020_05_01 are HTTP URL and user agent string.
  • the value of the table black_http_cc_2020_05_01 is the number of times the key appears on May 1, 2020.
  • the number of tables created by the gateway device is determined according to the memory capacity of the gateway device. 30 tables are examples of the number of tables created for malicious samples, and 7 tables are examples of the number of tables created for normal samples. The example does not limit the specific number of tables established by the gateway device.
  • the gateway device builds a table by date when storing HTTP C&C normal samples.
  • the keys of the table are the HTTP URL and user agent string of the message stream.
  • the value of the table is the number of occurrences of HTTP C&C normal samples on that day.
  • the gateway device builds up to 7 tables for HTTP C&C normal samples. 7 tables are used to save the data of HTTP C&C normal samples in the last 7 days.
  • the gateway device establishes the table white_http_cc_2020_05_01.
  • the table white_http_cc_2020_05_01 represents the data for the HTTP C&C normal sample on May 1.
  • the table white_http_cc_2020_05_01 is shown in Table 1 below.
  • the first gateway device obtains the number of occurrences of the first normal sample in the fourth time period, and the first gateway device determines whether the number of occurrences of the first normal sample in the fourth time period exceeds the first threshold. If the number of occurrences of the first normal sample in the fourth time period exceeds the first threshold, the first gateway device removes the first normal sample from the normal sample set.
  • the first normal sample is a normal sample in the normal sample set.
  • the fourth time period is the historical time period to which the moment when the first gateway device acquires the first normal sample belongs.
  • the time for the gateway device to process normal samples is May 1, 2020.
  • the gateway device combines the http_url and user agent of the normal sample into http_url_user agent_white_sample.
  • the gateway device queries the white_count corresponding to http_url_user agent_white_sample in the table white_http_cc_2020_05_01. If the number white_count exceeds the threshold t1, the gateway device discards normal samples. If the number white_count does not exceed the threshold t1, the gateway device updates the number white_count corresponding to http_url_user agent_white_sample in the white_http_cc_2020_05_01 table to be white_count+1.
  • the threshold t1 is an example of the first threshold.
  • the threshold t1 is, for example, set empirically, and the threshold t1 is, for example, 10,000.
  • the number white_count is an example of the number of occurrences of the first normal sample in the fourth time period. http_url_user agent_white_sample is an example of the first normal sample.
  • the first gateway device acquires the number of occurrences of the first malicious sample in the fifth time period, and the first gateway device determines whether the number of occurrences of the first malicious sample in the fifth time period exceeds a second threshold. If the number of occurrences of the first malicious sample in the fifth time period exceeds the second threshold, the first gateway device removes the first malicious sample from the malicious sample set.
  • the second threshold is smaller than the first threshold
  • the fifth time period is a historical time period to which the first gateway device acquires the first malicious sample.
  • the gateway device handles malicious samples on May 1, 2020.
  • the gateway device combines the malicious sample's http_url and user agent into http_url_user agent_black_sample.
  • the gateway device queries the black_count corresponding to http_url_user agent_black_sample in the table black_http_cc_2020_05_01. If the number black_count exceeds the threshold t2, the gateway device discards malicious samples. If the number black_count does not exceed the threshold t2, the gateway device updates the number black_count corresponding to http_url_user agent_black_sample in the black_http_cc_2020_05_01 table to be black_count+1.
  • May 1, 2020 is an example of the fifth time period when the historical time period is one day.
  • the threshold t2 is an example of the second threshold.
  • the threshold t2 is, for example, set empirically, and the threshold t2 is, for example, 1000.
  • the number black_count is an example of the number of occurrences of the first malicious sample in the fifth time period. http_url_user agent_black_sample is an example of the first malicious sample.
  • step S540 The steps performed by the gateway device in the initialization phase are illustrated below through step S540.
  • Steps S550 to S570 are used to illustrate the steps performed by the gateway device in one iteration in n iterations.
  • step S540 is about how the gateway device obtains malicious samples and hyperparameters from the cloud in the initialization stage
  • steps S550 to S570 are about how the gateway device optimizes model parameters in one iteration.
  • the first gateway device receives the shared samples and the hyperparameters of the detection model from the first server.
  • the shared sample is a malicious sample provided by the first server to each gateway device in the gateway device set.
  • Shared samples are, for example, metadata of C&C streams.
  • the shared sample is generated by the cloud attack knowledge base production system 1201 of the public cloud 120 .
  • the shared samples are delivered to each gateway device in the gateway device set by the federated learning server 1202 of the public cloud 120 .
  • the gateway device set includes the first gateway device and other gateway devices participating in federated learning.
  • the shared samples provided by the first server to each gateway device in the set of gateway devices are the same.
  • the gateway device set includes gateway device 1, gateway device 2...gateway device i...gateway device n, the first server provides the shared sample to gateway device 1, the shared sample provided to gateway device 2, and the shared sample provided to gateway device n.
  • the shared samples are the same. Therefore, when gateway device 1, gateway device 2...gateway device i...gateway device n participates in model training, the shared samples used by gateway device 1, gateway device 2...gateway device i...gateway device n are the same. Since the shared samples are shared by each gateway device during model training, the function of each gateway device sharing the same type of malicious samples to participate in model training is realized.
  • the cloud sends the shared malicious samples to the gateway device, and the gateway device participates in model training by using the malicious samples sent from the cloud.
  • malicious samples on different enterprises are generally seriously unbalanced, which will seriously affect the effect of the final model after the gateway device of the enterprise is selected as a participant of federated learning.
  • the cloud sends the malicious samples to the gateway devices of each enterprise, so that the gateway devices of each enterprise get the malicious samples from the cloud, so the malicious samples of the gateway devices of each enterprise will be more balanced.
  • different gateway devices perform model training based on more balanced malicious samples, it is obviously helpful to improve the effect of the trained model.
  • it helps to alleviate the problem of insufficient malicious samples in the sample set, and can provide more abundant malicious samples for the training of the detection model. Further, since the training of the model is driven by more abundant malicious samples, it helps to improve the accuracy of the detection model.
  • Hyperparameters include the learning rate of the detection model and the initial parameters of the detection model.
  • the hyperparameters provided by the first server to each gateway device in the set of gateway devices are the same, so that each gateway device trains its own detection model based on the same hyperparameter.
  • the initial parameters of the detection model and the initial parameters of the initial detection model are the same.
  • the initial parameters of the detection model are used to generate the initial detection model.
  • step S540 The steps performed in the initialization phase of the model training are described above through step S540.
  • the cloud sends the shared sample once in the initialization phase, and each gateway device locally saves the shared sample sent from the cloud. In each iteration, the cloud does not need to deliver the shared samples again, and each gateway device uses the pre-saved shared samples to participate in model training.
  • the first gateway device acquires the first model parameter from the first server.
  • the cloud will detect the model parameters of the model at the current iteration Sent to each gateway device participating in federated learning.
  • Each gateway device participating in federated learning receives the model parameters of the detection model at the current iteration in, is an illustration of the first model parameter. represents the model parameters at the t-th iteration.
  • G for example, represents the weight, is the weight of the model at the t-th iteration.
  • the first gateway device performs model training according to the malicious sample set, the shared sample, the first model parameter, and the normal sample set, so as to obtain a detection model after the model training.
  • each gateway device participating in federated learning uses local malicious samples, local normal samples, and the metadata of the C&C flow delivered by the cloud to train the model together.
  • the gateway device i will update the local model parameters
  • the gateway device i computes the updated model parameters by minimizing the loss function Gateway device i will local model parameters update to model parameters in, Represents the model parameters of the gateway device i before the update at the t-th iteration. Represents the updated model parameters of gateway device i at the t-th iteration.
  • the gateway device i represents one of the gateway devices participating in the federated learning.
  • the gateway device i is an example of the first gateway device.
  • gateway device i computes updated model parameters The steps are implemented based on the following formula (1).
  • arg represents an argument (argument).
  • min represents the minimum value. argmin means make The independent variable when the minimum value is reached value of .
  • the first gateway device sends the second model parameter to the first server.
  • the detection model after model training has the second model parameter.
  • the gateway device 110 participating in federated learning obtains the updated model parameters After that, the gateway device 110 will update the model parameters Sent to the federated learning server 1202 in the cloud. in, is an illustration of the second model parameter.
  • the gateway device described above obtains model parameters from the server, performs model training according to the model parameters delivered by the server, the local malicious sample set, the normal sample set and the shared samples, and reports the trained model parameters to the server. The steps are repeated until the loss function converges or the accuracy reaches the accuracy threshold.
  • the accuracy threshold is, for example, 99%.
  • FIG. 6 is an example of how the accuracy rate changes during training.
  • the abscissa of FIG. 6 represents the epoch of the iteration.
  • the ordinate of Fig. 6 represents the accuracy rate.
  • the curve in Figure 6 represents the relationship between accuracy and epoch. In general, the accuracy will gradually increase with the increase of epoch.
  • the accuracy threshold is 99%, and the training ends when the accuracy of three consecutive epochs is above 99%.
  • epoch refers to the process of performing a model training with all the samples in the training set.
  • one epoch is a process of training a detection model once with all malicious samples in the malicious sample set and all normal samples in the normal sample set.
  • the detection model is a convolutional neural network
  • one epoch is that all malicious samples in the malicious sample set and all normal samples in the normal sample set have one forward propagation and one reverse propagation in the convolutional neural network. the process of spreading.
  • the gateway device interacts with the server to receive model parameters and shared samples delivered by the server, and the gateway device uses the model parameters delivered by the server, shared samples and locally calibrated malicious samples to perform model training together , thereby improving the effect of model training, thereby improving the performance of the trained detection model.
  • the above describes the overall process of how the gateway device participates in federated learning.
  • the following is an example of how the gateway device calibrates the sample.
  • FIG. 7 is an example of the system architecture 100 shown in FIG. 1 described above.
  • FIG. 7 not only includes the two types of nodes of the gateway device and the public cloud shown in FIG. 1 , but also includes optional modules involved in calibrating malicious samples.
  • the gateway device includes two levels of threat detection modules.
  • the threat detection module of the first level includes a rule system and a detection model.
  • the rule system includes various rules for detecting packet flows.
  • the rule system specifically includes blocking rules (such as the HTTP C&C blocking rule 1102 shown in FIG. 7 ) and non-blocking rules.
  • the second-level threat detection module includes a local threat determination module (such as the HTTP C&C local threat determination module 1103 shown in FIG. 7 ), a cloud threat determination module, a cloud manual determination module, and a local manual determination module.
  • the local threat determination module is used for the gateway device to locally perform threat detection on the packet flow.
  • the local threat determination module is used to support the gateway device to perform execution based on whether the probability value is greater than the threshold, whether there is a domain generation algorithm (DGA) event, whether there is an intranet brute force cracking event, and whether there is an external sensitive information
  • DGA domain generation algorithm
  • the steps of determining whether a packet flow is a malicious packet flow is based on the leakage event and whether there is a distributed denial of service attack (DDoS) event on the external network.
  • DGA domain generation algorithm
  • DoS distributed denial of service attack
  • the cloud threat determination module is configured to request the enterprise private cloud 130 to perform threat detection on the packet flow, so as to send the events that cannot be determined locally to the cloud for threat determination.
  • the cloud threat determination module is configured to support the gateway device to perform the steps of sending the context information of the packet flow to the enterprise private cloud 130 and receiving the analysis result of the enterprise private cloud 130 .
  • the cloud manual judgment module is configured to provide the information of the packet flow to the operation and maintenance team of the cloud through the network, so that the operation and maintenance team of the cloud can manually perform threat judgment on the packet flow.
  • the local manual determination module is configured to output the information of the packet flow to the local operation and maintenance team, so that the local operation and maintenance team can manually perform threat determination on the packet flow.
  • the system architecture further includes an enterprise private cloud 130 .
  • the enterprise private cloud 130 is used to respond to the request of the cloud threat determination module and assist the gateway device to perform threat analysis. Specifically, when it is difficult for the gateway device to determine the threat locally, the gateway device will send the context information of the packet flow to the enterprise private cloud 130, and the enterprise private cloud 130 will comprehensively analyze the packet flow. After the enterprise private cloud 130 determines whether the packet flow is a malicious packet flow through analysis, the enterprise private cloud 130 returns the analysis result to the gateway device.
  • the enterprise private cloud 130 is, for example, any of a server, a mainframe, or a personal computer.
  • the enterprise private cloud 130 includes a correlation analysis and confirmation module, an intelligence correlation analysis module, and a manual analysis and confirmation module.
  • the working principle of the correlation analysis confirmation module is similar to that of the local threat determination module.
  • the intelligence correlation analysis module is used to perform threat determination on the packet flow with the help of threat intelligence.
  • the manual analysis and confirmation module is used to provide the information of the packet flow to the operation and maintenance team, and the operation and maintenance team manually determines the threat of the packet flow.
  • the enterprise private cloud 130 is connected with the global threat intelligence center 1203 and the APT advanced threat detection cloud service 1204 through a wireless network or a wired network.
  • the Global Threat Intelligence Center 1203 is used to provide threat intelligence.
  • the enterprise private cloud 130 obtains the threat intelligence provided by the global threat intelligence center 1203 by accessing the global threat intelligence center 1203 .
  • the APT advanced threat detection cloud service 1204 is used to detect APT advanced threats.
  • the enterprise private cloud 130 can request the APT advanced threat detection cloud service 1204 to further inspect the packet flow.
  • the system 100 shown in FIG. 7 is an example of the separate setting of the enterprise private cloud 130 and the gateway device 110 .
  • the enterprise private cloud 130 and the gateway device 110 are physically integrated together, and the enterprise private cloud 130 and the gateway device 110 are provided in the same hardware device.
  • each functional module included in the enterprise private cloud 130 and each functional module included in the gateway device 110 are set in the same hardware device.
  • the hardware device implements the function corresponding to the gateway device 110 and the function corresponding to the enterprise private cloud 130 , for example, the function corresponding to the local threat determination module and the function corresponding to the intelligence correlation analysis module.
  • the above introduces some optional modules and architectures involved in calibrating malicious samples with reference to FIG. 7 .
  • the following describes the method flow of calibrating malicious samples based on the architecture shown in FIG. 7 as an example.
  • specific implementation manners for the first gateway device to calibrate malicious samples include the following manners 1 to 3.
  • Modes 1 to 3 describe how the first gateway device uses the architecture shown in FIG. 7 to demarcate malicious samples, so as to use malicious samples to participate in federated learning.
  • Manner 1 The first gateway device obtains a malicious sample based on the blocking rule.
  • Blocking rules are used to block malicious packet flow.
  • the blocking rule indicates a correspondence between malicious packet flows and discard actions. When the packet flow hits the blocking rule, it indicates that the packet flow is a malicious packet flow, and the first gateway device discards the malicious packet flow according to the discarding action indicated by the blocking rule. Therefore, the transmission of the malicious packet flow will be interrupted at the first gateway device, thereby realizing the blocking of the malicious packet flow.
  • the packet flow matching the blocking rule is that the metadata of the packet flow and the metadata in the blocking rule satisfy a matching condition.
  • a blocking rule includes two entries, entry A and entry B.
  • Entry A includes metadata of the malicious packet flow, such as an internet protocol (IP) address.
  • Entry B includes the identification of the drop action (eg "drop", "deny”, etc.).
  • IP internet protocol
  • the first gateway device matches the metadata of the packet flow with the metadata in entry A, thereby judging whether the metadata of the packet flow and the metadata in the blocking rule satisfy the matching condition.
  • satisfying the matching condition includes various situations.
  • satisfying the matching condition means that the metadata of the packet flow is strictly matched with the metadata in the blocking rule, that is, the metadata of the packet flow is the same as the metadata in the blocking rule.
  • satisfying the matching condition means that the metadata of the packet flow matches the metadata in the blocking rule for the longest time.
  • the blocking rules are pre-stored in the memory of the first gateway device.
  • the blocking rule is issued by a server (eg, a private cloud server) to the first gateway device.
  • the first gateway device determines the metadata of the first packet flow as a malicious sample.
  • the first packet flow is a packet flow among at least one packet flow. For example, referring to FIG. 7 , after the packet flow enters the gateway device, if the packet flow hits the blocking rule 1102 of the HTTP C&C, the gateway device adds the metadata corresponding to the packet flow to the malicious sample set.
  • the blocking rule 1102 of the HTTP C&C is an example of the blocking rule.
  • the first method above provides a technical means for calibrating malicious samples on a gateway device. Since the gateway device obtains malicious samples from the packet flow transmitted by itself by means of blocking rules, the complexity of obtaining malicious samples is reduced, which helps to enrich the malicious samples in the malicious sample set. Further, because more malicious samples are provided for training the detection model, it is helpful to drive model training through more abundant malicious samples, thereby helping to improve the accuracy of the detection model.
  • Manner 2 The first gateway device acquires malicious samples based on the detection model before model training and local analysis.
  • each time the first gateway device performs model training the malicious samples required for this model training are obtained through the detection model before the current model training.
  • federated learning consists of four model training runs in total.
  • the first gateway device performs model training for the first time on the basis of detection model 0, so that detection model 0 is updated to detection model 1; the first gateway device performs model training for the second time on the basis of detection model 1, so that detection model 1 Update to detection model 2; the first gateway device performs model training for the third time on the basis of detection model 2, so that detection model 2 is updated to detection model 3; the first gateway device executes the model for the fourth time on the basis of detection model 3 Training, so that the detection model 3 is updated to the detection model 4.
  • the first gateway device calibrates malicious sample 0 by detecting model 0, and then performs model training according to malicious sample 0 for the first time; Model training is performed for the second time; the first gateway device calibrates malicious sample 2 by detecting model 2, and then performs model training for the third time according to malicious sample 2; the first gateway device calibrates malicious sample 3 by detecting model 3, and then according to malicious sample 3 Model training is performed for the fourth time.
  • the detection model 0 is an example of the initial detection model, and the malicious sample 0 is determined by, for example, the output result of the detection model 0 .
  • the detection model 1 is an example of the detection model before model training is performed for the second time, and the malicious sample 1 is determined by, for example, the output result of the detection model 1 .
  • the detection model 2 is an example of the detection model before model training is performed for the third time, and the malicious sample 2 is determined by, for example, the output result of the detection model 2 .
  • the detection model 3 is an example of the detection model before the fourth execution of the model training, and the malicious sample 3 is determined by, for example, the output result of the detection model 3 .
  • the initial detection model refers to the detection model before the model training when the first gateway device performs model training for the first time.
  • the initial detection model and the detection model obtained in the following steps have the same network architecture, such as which layers the model has and the connection relationship between different layers.
  • the model parameters of the initial detection model and the detection model obtained in the following steps may be different, for example, the weight of the convolution kernel may be different.
  • the output of the initial detection model indicates a probability value.
  • the probability value indicates the possibility that the second packet flow is a malicious packet flow, and the larger the probability value, the greater the possibility that the second packet flow is a malicious packet flow.
  • the threshold value B is greater than the threshold value A. For example, threshold B is 0.85 and threshold A is 0.5.
  • Local analysis refers to a technical means by which the first gateway device analyzes the packet flow.
  • the first gateway device continues to perform local analysis on the suspicious packet flow, so as to determine whether the metadata of the suspicious packet flow is a malicious sample .
  • the first gateway device inputs the metadata of the second packet flow into the detection model before the model training;
  • the output result of the detection model before training indicates that the second packet flow is a suspicious packet flow, and the first gateway device analyzes the second packet flow; if it is determined through analysis that the second packet flow is a malicious packet flow, the first The gateway device determines the metadata of the second packet flow as a malicious sample.
  • the packet flow does not match the blocking rule, for example, the metadata of the packet flow does not meet the matching condition with the metadata in the blocking rule.
  • blocking rules and matching conditions please refer to Method 1 above.
  • the gateway device inputs the HTTP metadata into the CNN model of the HTTP C&C.
  • the CNN model will predict the probability value that the message flow is a malicious message flow based on the input HTTP metadata; if the probability value predicted by the CNN model is greater than the threshold, the CNN model will report a suspicious HTTP C&C event; the gateway device responds to the suspicious HTTP C&C event and executes the The analytical method shown in Figure 8.
  • the second method above provides a technical means for calibrating malicious samples on the gateway device.
  • the gateway device uses the two methods of model and local analysis to jointly calibrate malicious samples, which improves the accuracy of malicious samples.
  • the modes of local analysis are exemplified below through modes (2-A) to (2-D).
  • the first gateway device performs local analysis according to the detection model and the threshold before the model training.
  • the first gateway device determines that the second packet flow is a malicious packet flow. For example, referring to Figure 8, after the packet flow enters the CNN model, if the probability value predicted by the CNN model exceeds 0.85, the CNN model will report a threat event, and the metadata of the packet flow will enter the malicious sample set. Among them, 0.85 is an example of the threshold value.
  • the first gateway device performs local analysis based on whether there is a DGA event.
  • the first gateway device determines whether there is a DGA event generated within the first time period; if there is a DGA event generated within the first time period, the first gateway device determines that the second packet flow is a malicious packet flow.
  • the first time period is a historical time period with the time when the first gateway device acquires the second packet flow as the end point.
  • the first time period is a time window with a duration of 5 minutes, and the end point of the time window of 5 minutes is the moment when the second packet flow is acquired.
  • the DGA event indicates that a first host accessing the DGA domain name has occurred.
  • the event source included in the DGA event is the first host.
  • the first host is the source host of the second packet flow.
  • the source IP address of the second packet flow is the first host.
  • DGA domain name refers to a random domain name generated using the DGA algorithm. DGA domain names are often used to trigger network attacks such as botnets or C&C.
  • the gateway device will determine whether a DGA event occurs on the host (the source host of the message flow) within the 5-minute time window; if the host has a DGA event within the 5-minute time window event, the gateway device will determine that there is a threat event, and the gateway device will add the metadata of the packet flow to the malicious sample set.
  • the first gateway device determines whether there is a DGA event includes various methods. For example, the first gateway device establishes and saves an access record in the process of transmitting the packet flow. The first gateway device queries the access record when performing local analysis. If the DGA event generated within the first time period is recorded in the access record, the first gateway device determines that there is a DGA event.
  • the access record is used to indicate the correspondence between the packet flow, the attack event and the generation time of the attack event. For example, the access record includes the metadata of the packet flow, the identifier of the attack event, and the generation time of the attack event, and the first gateway device queries the access record based on the metadata of the second packet flow and the second time period.
  • the first gateway device performs local analysis based on whether there is an intranet brute force cracking event, a sensitive information leakage event, or an extranet DDoS event.
  • the first gateway device determines whether there is an intranet brute force cracking event, a sensitive information leakage event, or an extranet DDoS event generated within the second time period. If there is an intranet brute force cracking event generated within the second time period, the first gateway device determines that the second packet flow is a malicious packet flow; or, if there is a sensitive information leakage event generated within the second time period, the first gateway device The gateway device determines that the second packet flow is a malicious packet flow; or, if there is an external network DDoS event generated within the second time period, the first gateway device determines that the second packet flow is a malicious packet flow.
  • the second time period is a historical time period with the time when the first gateway device obtains the second packet flow as the end point.
  • the second time period is a time window with a duration of one day, and the end point of the time window is the moment when the second packet flow is acquired.
  • the intranet brute force attack event indicates that a brute force attack has occurred targeting the intranet where the first host is located.
  • the sensitive information leakage event indicates that the sensitive information on the first host is sent to the external network. Sensitive information on the first host is, for example, user name, password, and the like.
  • the external network DDoS event indicates that a DDoS attack initiated by the internal network where the first host is located to the external network has occurred.
  • the first host is the source host of the second packet flow.
  • the gateway device will determine whether the host (the source host of the packet flow) has an intranet brute force cracking event, sensitive information leakage event or external event within 1 day.
  • Network DDoS events if the host has an intranet brute force attack event, sensitive information leakage event, or an external network DDoS event within 1 day, the gateway device will determine that there is a threat event, and the gateway device will add the metadata of the packet flow to the malicious sample. gather.
  • the first gateway device performs local analysis based on whether the output result of the detection model before the model training is periodic.
  • the first gateway device obtains the output result of the metadata of the target packet flow by the detection model before the model training in the third time period. If the detection model before the model training in the third time period is the metadata of the target packet flow The output result of the data presents periodicity, and the first gateway device determines that the second packet flow is a malicious packet flow.
  • the third time period is a historical time period whose end point is the moment when the first gateway device obtains the second packet flow.
  • the third time period is a time window with a duration of one day, and the end point of the time window is the moment when the second packet flow is acquired.
  • the target packet flow includes at least one packet flow with the first host as the source host.
  • the first host is the source host of the second packet flow.
  • the gateway device will determine whether the HTTP C&C events reported by the CNN model for the host (the source host of the message flow) within 1 day are periodic; if The CNN model presents periodicity for the HTTP C&C events reported by the host within one day, and the gateway device will determine that there is a threat event and add the metadata of the packet flow to the malicious sample set.
  • the above methods (2-A) to (2-D) provide a variety of technical means for the gateway device to calibrate malicious samples through local analysis, which helps to solve the problem of difficulty in obtaining malicious samples and helps to collect more high-quality malicious samples. sample.
  • the four analysis modes shown in the above-mentioned modes (2-A) to (2-D) are used in combination.
  • any one of the four analysis methods shown in the mode (2-A) to the mode (2-D) indicates that the second packet flow is a malicious packet flow
  • the first gateway device will metadata identified as malicious samples.
  • the four judgment conditions expressed in the modes (2-A) to (2-D) are combined in the relation of OR.
  • association analysis The way in which the above-mentioned ways (2-A) to (2-D) are used in combination can be referred to as association analysis.
  • the method 2 above describes how the first gateway device performs local analysis.
  • the operation and maintenance personnel further analyze the packet flow by manual analysis.
  • the first gateway device provides a world wide web (web) access interface. If it is analyzed that a packet flow is not a malicious packet flow, the first gateway device provides the metadata of the packet flow to the operation and maintenance personnel through the web access interface. The O&M personnel manually analyze the packet flow. If the result of manual analysis is that the packet flow is a malicious packet flow, the first gateway device adds the metadata of the packet flow to the malicious sample set. If the result of manual analysis is that the packet flow is a normal packet flow, the first gateway device adds the metadata of the packet flow to the normal sample set.
  • the first gateway device further uses the detection model before model training to calibrate the normal samples. For example, if the packet flow does not meet the blocking rule, the first gateway device inputs the metadata of the packet flow into the detection model before model training; if the output result of the detection model before model training indicates that the packet flow is not a suspicious packet flow , the first gateway device determines the metadata of the packet flow as a normal sample.
  • the gateway device inputs the HTTP metadata into the CNN model of the HTTP C&C.
  • the CNN model will predict the probability value that the message flow is a malicious message flow based on the input HTTP metadata; if the probability value predicted by the CNN model is less than the threshold and the CNN model does not report any suspicious HTTP C&C events, the metadata of this message flow will be will be added to the normal sample set.
  • Manner 3 The first gateway device requests cloud threat analysis to obtain malicious samples.
  • the gateway device 110 will add the context information of the packet flow to the context information of the packet flow when it is difficult for the gateway device to determine whether the packet flow is a malicious packet flow.
  • the enterprise private cloud 130 performs threat analysis according to the context information of the packet flow.
  • the enterprise private cloud 130 determines whether the packet flow is a malicious packet flow or a normal packet flow, and obtains an analysis result.
  • the enterprise private cloud 130 returns the analysis result to the gateway device 110 .
  • the gateway device 110 determines whether the packet flow is a malicious packet flow or a normal packet flow according to the analysis result of the enterprise private cloud 130 . If the gateway device 110 finds that the packet flow is a malicious packet flow according to the analysis result of the enterprise private cloud 130, the gateway device 110 adds the metadata of the malicious packet flow to the malicious sample set. If the gateway device 110 finds that the packet flow is a normal packet flow according to the analysis result of the enterprise private cloud 130, the gateway device 110 adds the metadata of the normal packet flow to the normal sample set.
  • the first gateway device sends the context information of the third packet flow to the second server; the second The server receives the context information of the third packet flow from the first gateway device; the second server analyzes according to the context information to obtain the analysis result; the second server sends the analysis result to the first gateway device.
  • the first gateway device receives the analysis result obtained according to the context information from the second server; if the analysis result indicates that the third packet flow is a malicious packet flow, the first gateway device determines the metadata of the third packet flow as malicious sample.
  • the third packet flow is one of the at least one packet flow acquired by the first gateway device.
  • the context information includes at least one item of metadata of the third packet flow or a packet capture (packet capture, PCAP) packet of the third packet flow.
  • the analysis result is used to indicate whether the third packet flow is a malicious packet flow.
  • the analysis result includes two values, one value indicates that the third packet flow is a malicious packet flow, and the other value indicates that the third packet flow is not a malicious packet flow.
  • the cloud analyzes whether a packet flow is a malicious packet flow includes various methods.
  • the cloud analyzes the packet flow with threat intelligence.
  • threat intelligence is evidence-based knowledge about existing or potential threats to Internet technology (IT) or information assets.
  • the content of the threat intelligence includes at least one of malicious IP addresses, normal IP addresses, malicious domain names, and malicious file identifiers.
  • Malicious IP addresses and normal IP addresses are two types of IP addresses.
  • the user of the malicious IP address has performed malicious behaviors such as network attacks that endanger the business. Malicious IP addresses are also known as black IPs.
  • the normal IP address refers to the IP address used by normal users.
  • a normal IP address is also called a white IP.
  • Malicious domain names are used to conduct network attacks.
  • a malicious domain name is a domain name for malicious software (such as mining virus, botnet, ransomware, etc.) to maintain communication between the controlled terminal and the control server.
  • Malicious file identification is used to identify malicious files.
  • a malicious file is identified as a message-digest algorithm (MD5) code of a malicious file.
  • MD5 message-digest algorithm
  • the methods (3-A) to (3-C) are used to illustrate how the cloud analyzes the threat intelligence.
  • the second server determines according to the destination IP address included in the third packet flow or the The source IP address is used to query the first threat intelligence; if the destination IP address or the source IP address hits the malicious IP address in the first threat intelligence, the second server takes the third packet flow as a malicious packet flow as the analysis result. If the destination IP address or the source IP address matches the normal IP address in the first threat information, the second server takes the third packet flow as an analysis result that is not a malicious packet flow.
  • the first threat information includes at least one malicious IP address and at least one normal IP address.
  • Mode (3-B) Cloud is based on threat intelligence analysis containing malicious domain names.
  • the second server queries the second threat intelligence according to the target domain name corresponding to the third packet flow; if The target domain name hits the malicious domain name in the second threat intelligence, and the second server takes the third packet flow as a malicious packet flow as an analysis result. If the target domain name hits a normal domain name in the second threat intelligence, the second server takes the third packet flow as an analysis result that is not a malicious packet flow.
  • the second threat intelligence includes at least one malicious domain name and at least one normal domain name. Malicious domain names are also called black domain names, and normal domain names are also called white domain names.
  • the target domain name is the domain name requested to be accessed by the third packet flow.
  • Mode (3-C) Cloud is based on threat intelligence analysis containing malicious file identifiers.
  • the second server queries the third threat intelligence according to the file identifier corresponding to the third packet flow; if The file identifier matches the malicious file identifier in the third threat intelligence, and the second server takes the third packet stream as a malicious packet stream as an analysis result.
  • the third threat intelligence includes at least one malicious file identifier.
  • the cloud not only analyzes the packet flow by means of threat intelligence, but also further analyzes the packet flow in a manner similar to the local analysis of the gateway device.
  • the process of cloud analysis specifically includes the following modes (3-1) to (3-7).
  • Mode (3-1) The cloud queries the threat intelligence corresponding to the packet flow. If it is found by querying the threat intelligence that the packet flow is a malicious packet flow, the cloud takes the packet flow as a malicious packet flow as an analysis result.
  • mode (3-1) please refer to the above mode (3-A) to mode (3-C).
  • Method (3-2) The cloud determines whether the host (source host of the packet stream) has file download behavior within one day; if the host has file download behavior within one day, the cloud obtains the file downloaded by the host from the packet stream; the cloud will The file is sent to the cloud sandbox, and the file is run through the cloud sandbox. If the cloud sandbox determines that the file is a malicious file, the cloud determines that there is a threat event, and the cloud uses the packet flow as a malicious packet flow as the analysis result.
  • Method (3-3) The cloud determines whether the source host of the packet flow has received phishing emails within one day; if the source host of the packet flow has received phishing emails within one day, the cloud determines that there is a threat event, and the cloud sends the packet The flow is the malicious packet flow as the analysis result.
  • Method (3-4) The cloud determines whether the source host of the packet flow within a week has an intranet brute force attack event, sensitive information leakage event or an external network DDoS incident; if the source host of the packet flow within a week has an intranet brute force incident In the event of cracking, sensitive information leakage, or external network DDoS events, the cloud determines that there is a threat event, and the cloud uses the packet flow as a malicious packet flow as the analysis result.
  • Method (3-5) The cloud determines whether the HTTP C&C events reported by the source host of the packet flow by the CNN model within a week are periodic; if the CNN model is the HTTP C&C event reported by the source host of the packet flow within a week, the period The cloud determines that there is a threat event, and the cloud uses the packet flow as a malicious packet flow as the analysis result.
  • the method (3-5) is the same as the above-mentioned method (2-D).
  • Method (3-6) The cloud determines whether the multi-flow AI model containing the packet flow reports a threat event. If the multi-flow AI model reports a threat event, the cloud determines that there is a threat event, and the cloud analyzes whether the packet flow is a malicious packet flow. result.
  • the above methods (3-1) to (3-7) are used in combination. For example, if the threat level is higher than the threshold value, when any one of the modes (3-1) to (3-7) indicates that the packet flow is a malicious packet flow, the first gateway device stores the metadata of the packet flow Determined to be a malicious sample. If the threat level is lower than the threshold, and when there are multiple methods in the modes (3-1) to (3-7), all of which indicate that the packet flow is a malicious packet flow, the first gateway device determines the metadata of the packet flow. for malicious samples. In other words, whether the seven conditions shown in the modes (3-1) to (3-7) are combined in an OR relationship or an AND relationship is determined according to the level of the threat, which is not limited in this embodiment.
  • the above manners (3-1) to (3-7) provide various implementation manners for how the cloud analyzes. Due to the combination of multiple methods for threat determination, the cloud helps to improve the accuracy of the determined malicious samples.
  • the third method above introduces the process of cloud threat analysis. If the cloud determines that there is a threat event based on the packet flow, the metadata of the packet flow will enter the malicious sample collection. If the cloud operation and maintenance team in mode (3-7) manually analyzes that the packet flow is a normally accessed packet flow, the metadata of the packet flow will enter the normal sample set.
  • the act of analyzing with threat intelligence is performed locally by the gateway device.
  • the gateway device is physically integrated with the private cloud server.
  • the gateway device has the performance and storage capacity required to query threat intelligence.
  • the gateway device replaces the cloud to calibrate malicious samples based on threat intelligence.
  • the methods (3-a) to (3-c) are used to illustrate how the gateway device analyzes with the help of threat intelligence.
  • the gateway device is based on threat intelligence analysis containing malicious IP addresses.
  • the first gateway device may include the destination IP address included in the third packet flow or the third packet flow including If the destination IP address included in the third packet flow or the source IP address included in the third packet flow hits the malicious IP address in the first threat intelligence, the first gateway device will The metadata of the three-packet flow is determined to be a malicious sample.
  • the gateway device is based on threat intelligence analysis containing malicious domain names.
  • the first gateway device queries the second threat intelligence according to the target domain name corresponding to the third packet flow;
  • the target domain name corresponding to the packet flow hits the malicious domain name in the second threat intelligence, and the first gateway device determines the metadata of the third packet flow as a malicious sample.
  • the target domain name is the domain name requested to be accessed by the third packet flow, and the second threat information includes at least one malicious domain name.
  • the gateway device is based on threat intelligence analysis containing malicious file identifiers.
  • the first gateway device queries the third threat intelligence according to the file identifier corresponding to the third packet flow;
  • the file identifier corresponding to the packet flow matches the malicious file identifier in the third threat intelligence, and the first gateway device determines the metadata of the third packet flow as a malicious sample.
  • the file identifier is used to identify the file included in the third packet stream, and the third threat intelligence includes at least one malicious file identifier.
  • the above manners 1 to 3 are used in combination.
  • two or more of the modes from the first mode to the third mode are combined in an OR relationship.
  • the relationship between two or more of the manners 1 to 3 is combined. This embodiment does not limit how the three manners are combined.
  • the first gateway device obtains malicious samples based on blocking rules, detection models before model training, and local analysis.
  • method 600 is about how the server aggregates model parameters on gateway devices participating in federated learning.
  • the method 600 mainly describes the process performed by the server when two gateway devices participate in federated learning, and reflects how the server aggregates the model parameters reported by the two gateway devices. When a larger number of gateway devices participate in federated learning, the server performs the same method.
  • FIG. 10 is a flowchart of a method 600 for training a detection model provided by an embodiment of the present application.
  • the method 600 includes S610 to S660.
  • the first server generates a shared sample.
  • shared samples are generated through sandboxing.
  • the first server runs a malicious file in the sandbox, and obtains at least one PCAP message; the first server generates a shared sample according to the at least one PCAP message.
  • the attack knowledge base production system 1201 selects malicious PE samples from the malicious message flow.
  • the first server obtains shared samples from data generated by HTTP C&C threat events collected from friendly enterprises.
  • the first server determines a set of gateway devices participating in federated learning.
  • the first server determines some gateway devices as participants of federated learning, and schedules these gateway devices to perform model training.
  • Determining which gateway devices participate in federated learning by the first server includes various implementations.
  • the first server determines gateway devices participating in federated learning according to at least one of computing capability, resource status, communication bandwidth, or data quality of each gateway device. For example, the first server determines a gateway device whose computing capability satisfies the requirement according to the computing capability requirement of the model training. For another example, the first server determines, according to the resource utilization rate of each gateway device, a gateway device whose resource utilization rate is lower than the utilization rate threshold. For another example, the first server determines, according to the communication bandwidth of each gateway device, a gateway device whose communication bandwidth is greater than the bandwidth threshold. For another example, the first server determines a gateway device whose data quality is higher than a quality threshold according to the data quality of each gateway device.
  • the first server sends the hyperparameter and the shared sample to at least one gateway device in the gateway device set.
  • the first server starts the model training task periodically (for example, once a month), and sends the hyperparameters of the detection model and the shared samples to the selected gateway device.
  • the shared samples are malicious samples provided by the server to each gateway device in the gateway device set, and the hyperparameters include initial parameters and learning rates.
  • the initial parameters are the initial parameters of the first detection model and the second detection model.
  • the learning rate is the learning rate of the first detection model and the second detection model.
  • the first detection model refers to a detection model trained and applied by the first gateway device. The first detection model is used to detect whether the packet flow transmitted through the first gateway device is malicious.
  • the second detection model refers to the detection model trained and applied by the second gateway device. The second detection model is used to detect whether the packet flow transmitted through the second gateway device is malicious.
  • the first detection model and the second detection model have the same initial parameters. For example, the first detection model and the second detection model have the same learning rate.
  • the first server receives the first model parameter from the first gateway device in the gateway device set, and the second model parameter from the second gateway device in the gateway device set.
  • the gateway device set includes a first gateway device and a second gateway device, and optionally the gateway device set further includes other gateway devices other than the first gateway device and the second gateway device.
  • the first model parameters are parameters of the first detection model.
  • the second model parameters are parameters of the second detection model.
  • the first model parameter is a gradient value of the first detection model.
  • the second model parameter is the gradient value of the second detection model.
  • the first server performs aggregation processing according to the first model parameter and the second model parameter to obtain a third model parameter.
  • the process of aggregation processing includes the following steps 1 to 3.
  • Step 1 The first server obtains the average value of the first model parameter and the second model parameter.
  • Step 2 The first server obtains the variation of the model parameters according to the average value and the learning rate.
  • the amount of change in the model parameters is the product of the mean of the model parameters and the learning rate.
  • Step 3 The first server updates the historical model parameters according to the variation to obtain third model parameters.
  • the first server calculates the difference between the historical model parameter and the variation of the model parameter, and uses the difference as the third model parameter.
  • the third model parameter is the difference between the historical model parameter and the delta.
  • the historical model parameters are model parameters sent by the first server to at least one gateway device in the set of gateway devices before receiving the first model parameter and the second model parameter.
  • the first server sends the third model parameter to at least one gateway device in the gateway device set.
  • the first server sends the third model parameter to at least one of the first gateway device or the second gateway device; or, the first server sends the third model parameter to one or more other than the first gateway device and the second gateway device.
  • a gateway device sends the third model parameter.
  • the first server sends the third model parameter to all gateway devices in the gateway device set.
  • the above steps S640 to S660 take the case of two gateway devices participating in federated learning as an example to illustrate how the server aggregates the model parameters reported by the two gateway devices.
  • the method flow described in the above steps can be applied to the scenario of aggregating model parameters reported by a larger number of gateway devices.
  • the following is an example of how the server aggregates the model parameters reported by n gateway devices.
  • n is a positive integer greater than or equal to 2.
  • the server aggregates the model parameters reported by the n gateway devices. Specifically, the server calculates and minimizes the local loss function based on the following formula (2) and formula (3), and obtains the updated model parameters Then, the server will update the model parameters Sent to n gateway devices, so that the model parameters on each gateway device participating in federated learning are updated.
  • w t+1 represents the model parameters obtained by the aggregation processing at the t-th iteration, or the updated model parameters obtained at the t-th iteration.
  • w t represents the historical model parameters used for the t-th iteration.
  • w t is, for example, the model parameter sent to the gateway device at the (t-1)th iteration. is the variation of the model parameters at the t-th iteration.
  • ⁇ represents the learning rate. represents the mean of the model parameters.
  • n represents the number of gateway devices participating in federated learning.
  • k indicates that the calculation is performed for the kth gateway device participating in federated learning.
  • ⁇ is the summation symbol.
  • Equation (2) and Equation (3) are examples of a fixed learning rate based distributed gradient descent algorithm to update model parameters. Formulas (2) and (3) assume that the samples owned by different gateway devices participating in federated learning meet the IID conditions, different gateway devices participating in federated learning have initial parameters of the detection model, and each gateway device participating in federated learning understands the optimizer (such as distributed gradient descent algorithm) settings.
  • the server receives the model parameters uploaded by each gateway device, performs aggregation processing on the model parameters uploaded by each gateway device, and sends the aggregated model parameters to each gateway device, so that the gateway device can use the aggregation process.
  • the processed model parameters are used for model training, thereby improving the effect of the gateway device model training, thereby improving the performance of the trained detection model.
  • the method on the model training side is described above through the method 500 and the method 600, and the method on the model application side is introduced below.
  • the detection model provided in this embodiment is used by the gateway device to detect whether the packet flow subsequently transmitted through the gateway device is malicious. For example, after the first gateway device is trained to obtain the first detection model, the first gateway device is saving the first detection model. When the first network device subsequently receives the packet flow, the first gateway device extracts the metadata of the packet flow; the first network device inputs the metadata of the packet flow into the first detection model, and uses the first detection model to detect the packet flow. The metadata of the flow is processed, and the type of the output packet flow or the probability value that the packet flow is a malicious packet flow.
  • the first gateway device determines that the packet flow is a malicious packet flow. If the type of the packet flow is a normal packet flow or the probability value that the packet flow is a malicious packet flow is less than the threshold, the first gateway device determines that the packet flow is a normal packet flow.
  • the detection model as the CNN model as an example, an example of how to apply the detection model to detect the packet flow is illustrated.
  • the process 700 of the gateway device applying the CNN model to detect the packet flow includes the following steps S710 to S760.
  • steps S710 to S720 relate to how the gateway device preprocesses the input data.
  • the gateway device can convert the data format of the metadata of the message stream from a string to a matrix, so that the convolutional layer of the detection model can process the metadata in the matrix format.
  • Steps S710 to S720 relate to various processing actions sequentially performed on the metadata by each layer inside the CNN model.
  • steps S710 to S720 are performed by detecting a certain layer built in the model.
  • steps S710 to S720 are performed by a preprocessing module provided separately from the detection model.
  • Step S710 The gateway device uses the segmentation symbol to perform word segmentation on the HTTP metadata of the packet flow, so as to obtain a plurality of words included in the HTTP metadata.
  • http, test, com, path, file, key, paS6word, get, exploit, and js are all examples of words obtained by segmentation.
  • Step S720 the gateway device respectively vectorizes each word through a model (word to vector, Word2vec) used to generate word vectors, thereby obtaining a matrix.
  • a model word to vector, Word2vec
  • a matrix consists of multiple rows. Each row of the matrix is a vector, and each vector represents a word.
  • the number of rows of the matrix is preset to n. If the number of obtained words exceeds n, the gateway device selects the first n words from all the obtained words, and the gateway device vectorizes the first n words respectively, thereby obtaining a matrix of n rows; if the number of obtained words is less than n, The gateway device vectorizes all the obtained words and fills them with 0 respectively, thereby obtaining a matrix. For example, after the gateway device vectorizes http, test, com, path, file, key, paS6word, get, exploit, and js respectively, the resulting matrix includes n rows and d dimensions.
  • the first row of the matrix represents the d-dimensional vector of http; the second row of the matrix represents the d-dimensional vector of test; the third row of the matrix represents the d-dimensional vector of com, and so on, the last row of the matrix represents the d-dimensional vector of exploit vector, the last 1 row of the matrix represents the d-dimensional vector of js.
  • the gateway device obtains a matrix Rn*d after performing step S720.
  • the matrix Rn*d is a matrix with n rows and d dimensions.
  • d represents the dimension of the vector.
  • n represents the number of rows of the matrix.
  • Step S730 the gateway device performs convolution processing on the matrix through the convolution layer of the CNN model to obtain the message flow feature.
  • the packet flow characteristics are the characteristics indicated by the metadata of the packet flow.
  • the form of the packet flow feature is, for example, a vector or a matrix.
  • the convolutional layer of a CNN model includes multiple filters.
  • the weights for each filter are a matrix.
  • the dimension of the matrix corresponding to the filter is the same as the dimension of the matrix obtained in step S720.
  • the weights of the filters are the matrix Rt*d.
  • the number of filters included in the convolutional layer is, for example, 50.
  • Step S740 The gateway device performs maximum pooling processing on the packet flow features through the pooling layer of the CNN model to obtain the pooled features.
  • Step S750 the gateway device performs linear mapping and nonlinear mapping on the packet flow feature through the fully connected layer of the CNN model to obtain the mapped feature.
  • linear and nonlinear mappings are implemented by rectified linear unit (ReLU) or other activation functions.
  • ReLU rectified linear unit
  • Step S760 The gateway device classifies the mapped features through the output layer of the CNN model, and outputs the type of the packet flow, where the type of the packet flow is a malicious packet flow or a normal packet flow.
  • the gateway device 800 introduced below has any of the functions of the first gateway device in the above method 500 .
  • FIG. 12 shows a possible schematic structural diagram of the first gateway device involved in the above embodiment.
  • the gateway device 800 shown in FIG. 12 for example, implements the function of the first gateway device in the method 500 .
  • the gateway device 800 includes an acquisition module 801 , a training module 802 and a transmission module 803 .
  • Each module in the gateway device 800 is implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • Each module in the gateway device 800 is used to perform the corresponding function of the first network device in the above method 500 .
  • the obtaining module 801 is configured to support the gateway device 800 to perform S510, S520, and S550.
  • the training module 802 is used to support the gateway device 800 to perform S560.
  • the sending module 803 is configured to support the gateway device 800 to perform S570.
  • the various modules in the gateway device 800 are integrated into one module.
  • each module in the gateway device 800 is integrated on the same chip.
  • the chip includes a processing circuit, an input interface and an output interface that are internally connected and communicated with the processing circuit.
  • the training module 802 is implemented by the processing circuit in the chip.
  • the acquiring module 801 is implemented through an input interface in the chip.
  • the sending module 803 is implemented through an output interface in the chip.
  • the chip uses one or more field programmable gate arrays (full name in English: field-programmable gate array, English abbreviation: FPGA), programmable logic device (full English name: programmable logic device, English abbreviation: PLD), controller , state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • field programmable gate arrays full name in English: field-programmable gate array, English abbreviation: FPGA
  • programmable logic device full English name: programmable logic device, English abbreviation: PLD
  • controller state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • each module of the gateway device 800 exists physically separately. In other embodiments, a part of the modules of the gateway device 800 exist physically separately, and another part of the modules are integrated into one module.
  • the training module 802 in the gateway device 800 is implemented by, for example, the processor 201 in the device 200 .
  • the acquiring module 801 and the sending module 803 in the gateway device 800 are implemented by, for example, the network interface 204 in the device 200 .
  • each module in the gateway device 800 is, for example, software generated after the processor 201 in the device 200 reads the program code 210 stored in the memory 203 .
  • the gateway device 800 is a virtualized device.
  • the virtualization device includes, but is not limited to, at least one of a virtual machine, a container, and a Pod.
  • the gateway device 800 is deployed on a hardware device (eg, a physical server) in the form of a virtual machine.
  • the gateway device 800 is implemented based on a general physical server combined with a Network Functions Virtualization (NFV) technology.
  • NFV Network Functions Virtualization
  • the gateway device 800 When implemented by a virtual machine, the gateway device 800 is, for example, a virtual host, a virtual router or a virtual switch. Those skilled in the art can virtualize the gateway device 800 on a general physical server in combination with the NFV technology by reading this application.
  • the gateway device 800 is deployed on a hardware device in the form of a container (eg, a docker container).
  • the process of the gateway device 800 executing the above method embodiments is encapsulated in an image file, and the hardware device creates the gateway device 800 by running the image file.
  • the gateway device 800 is deployed on a hardware device in the form of a Pod.
  • a Pod includes a plurality of containers, and each container is used to implement one or more modules in the gateway device 800 .
  • the server 900 described below has any of the functions of the first server in the above method 700 .
  • FIG. 13 shows a possible schematic structural diagram of the first server involved in the above embodiment.
  • the server 900 shown in FIG. 13 implements the function of the first server in the method 700 .
  • the server 900 includes a receiving module 901 , a processing module 902 and a sending module 903 .
  • Each module in the server 900 is implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • Each module in the server 900 is used to execute the corresponding function of the first server in the above method 700 .
  • the receiving module 901 is used to support the server 900 to perform S640.
  • the processing module 902 is used to support the server 900 to execute S650.
  • the sending module 903 is used to support the server 900 to execute S660.
  • the receiving module 901, the processing module 902 or the sending module 903 are further configured to support the server 900 to perform other processes performed by the first server in the technology described herein.
  • the processing module 902 is further configured to support the server 900 to perform S610 or S620.
  • the sending module 903 is further configured to support the server 900 to execute S660.
  • the specific execution process of the server 900 please refer to the detailed description of the corresponding steps in the method 700, which will not be repeated here.
  • the various modules in the server 900 are integrated into one processing module.
  • each module in the server 900 is integrated on the same chip.
  • the chip includes a processing circuit, an input interface and an output interface that are internally connected and communicated with the processing circuit.
  • the processing module 902 is implemented by a processing circuit in the chip.
  • the receiving module 901 is implemented through an input interface in the chip.
  • the sending module 903 is implemented through an output interface in the chip.
  • the chip uses one or more field programmable gate arrays (full name in English: field-programmable gate array, English abbreviation: FPGA), programmable logic device (full English name: programmable logic device, English abbreviation: PLD), controller , state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • field programmable gate arrays full name in English: field-programmable gate array, English abbreviation: FPGA
  • programmable logic device full English name: programmable logic device, English abbreviation: PLD
  • controller state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • each module of the server 900 exists physically separately. In other embodiments, some modules of the server 900 exist physically separately, and other modules are integrated into one module.
  • the processing module 902 and the sending module 903 are the same module. In other embodiments, the processing module 902 and the sending module 903 are different modules.
  • the integration of different modules is implemented in the form of hardware, that is, different modules correspond to the same hardware. For another example, the integration of different modules is implemented in the form of software modules.
  • the processing module 902 in the server 900 is implemented by, for example, the processor 201 in the device 200 .
  • the receiving module 901 and the sending module 903 in the server 900 are implemented by, for example, the network interface 204 in the device 200 .
  • each module in the server 900 is, for example, software generated after the processor 201 in the device 200 reads the program code 210 stored in the memory 203 .
  • the server 900 is a virtualized device.
  • the virtualization device includes, but is not limited to, at least one of a virtual machine, a container, and a Pod.
  • the server 900 is deployed on a hardware device (eg, a physical server) in the form of a virtual machine.
  • the server 900 is implemented based on a general-purpose physical server in conjunction with NFV technology.
  • the server 900 is, for example, a virtual host, a virtual router or a virtual switch.
  • the server 900 is deployed on a hardware device in the form of a container (eg, a docker container).
  • a container eg, a docker container
  • the process of the server 900 executing the above method embodiments is encapsulated in an image file, and the hardware device creates the server 900 by running the image file.
  • the server 900 is deployed on a hardware device in the form of a Pod.
  • a Pod includes a plurality of containers, and each container is used to implement one or more modules in the server 900 .
  • a computer program product includes computer instructions stored in a computer-readable storage medium.
  • the processor of the gateway device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the gateway device to perform the method 500 .
  • a computer program product comprising computer instructions stored in a computer readable storage medium.
  • the processor of the server reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the server to perform the method 600 .
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the modules is only a logical function division. In actual implementation, there may be other division methods.
  • multiple modules or components may be combined or Integration into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or modules, and may also be electrical, mechanical or other forms of connection.
  • modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, may be located in one place, or may be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present application.
  • each module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically alone, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules may be implemented in the form of hardware or in the form of software modules.
  • the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may be stored in a computer-readable storage medium.
  • the technical solutions of the present application are essentially or part of contributions to the prior art, or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .
  • first and second are used to distinguish the same or similar items with basically the same function and function. It should be understood that there is no logic or sequence between “first” and “second”. There are no restrictions on the number and execution order. It will also be understood that, although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.
  • a first gateway device may be referred to as a second gateway device, and similarly, a second gateway device may be referred to as a first gateway device, without departing from the scope of the various examples. Both the first gateway device and the second gateway device may be gateway devices, and in some cases, may be separate and distinct gateway devices.
  • the term “if” may be interpreted to mean “when” ("when” or “upon”) or “in response to determining” or “in response to detecting.”
  • the phrases “if it is determined" or “if a [statement or event] is detected” can be interpreted to mean “when determining" or “in response to determining... ” or “on detection of [recited condition or event]” or “in response to detection of [recited condition or event]”.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer program instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of the present application are generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program instructions may be transmitted from a website site, computer, server or data center via Wired or wireless transmission to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media integrated.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, digital video discs (DVDs), or semiconductor media (eg, solid state drives), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Artificial Intelligence (AREA)
  • Medical Informatics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Health & Medical Sciences (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供了一种检测模型的训练方法、系统、设备及存储介质，属于网络安全技术领域，进一步涉及AI技术在网络安全技术领域中的应用。本申请一些实施例提供了采用联邦学习训练检测模型的方法。该方法中，由网关设备作为联邦学习的参与者，由服务器为网关设备汇聚模型参数以及下发共享的恶意样本。在网关设备执行模型训练时，网关设备与服务器会交互模型参数、共享样本等信息，从而训练得到检测模型。该方法有助于缓解恶意样本不足的问题，能通过更加丰富的恶意样本驱动检测模型的训练，提升模型训练的效果。

Description

检测模型的训练方法、系统、设备及存储介质
本申请要求于2020年09月10日提交的申请号为202010948783.1、发明名称为“检测模型的训练方法、系统、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全技术领域，进一步涉及人工智能(Artificial Intelligence，AI)技术在网络安全技术领域中的应用，特别涉及一种检测模型的训练方法、系统、设备及存储介质。
背景技术
随着人工智能(artificial intelligence，AI)技术的不断发展，如何应用AI技术来检测恶意报文流已成为网络安全领域的研究热点。应用AI技术来识别恶意报文流的基本原理是计算机利用机器学习算法对恶意样本和正常样本进行模型训练，得到检测模型，机器学习算法例如卷积神经网络(convolutional neural network，CNN)。在模型训练过程中，通过恶意样本，检测模型能够学习到恶意报文流具有的特征；通过正常样本，检测模型能够学习到正常报文流具有的特征。因此在预测阶段，计算机通过检测模型，能够自动化地区分一个报文流是恶意报文流还是正常报文流。其中，报文流(traffic flow)是指从一个源主机到目的方的一系列报文。其中目的方例如是另一个主机、包含多个主机的多播组、或者广播域。
然而，由于恶意样本难以获取、难以标定，经常出现恶意样本不足的情况。如果训练检测模型时使用的恶意样本不足，会影响训练检测模型的效果，导致计算机使用训练得到的检测模型检测报文流时，误报率较高、攻击覆盖率不够。
发明内容
本申请实施例提供了一种检测模型的训练方法、系统、设备及存储介质，能够提升模型训练的效果，从而有助于提升检测模型的性能。所述技术方案如下：
第一方面，提供了一种检测模型的训练方法，以参与联邦学习的网关设备的角度描述，在该方法中，第一网关设备获取通过所述第一网关设备传输的至少一条报文流；所述第一网关设备根据所述至少一条报文流获取恶意样本集合，所述恶意样本集合中包括的恶意样本为所述至少一条报文流中恶意报文流的元数据；所述第一网关设备从第一服务器获取第一模型参数；所述第一网关设备根据所述恶意样本集合、共享样本和所述第一模型参数进行模型训练，从而得到模型训练之后的检测模型，所述共享样本为所述第一服务器提供给网关设备集合中的各个网关设备的恶意样本，所述网关设备集合中包括所述第一网关设备，所述检测模型用于所述第一网关设备对后续通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述模型训练之后的检测模型具有第二模型参数；所述第一网关设备向所述第一服务器发送所述第二模型参数。
在以上方法中，由于网关设备不仅利用自身传输的报文流标定恶意样本，还接收了服务 器下发的共享的恶意样本以及模型参数，网关设备利用本地标定的恶意样本、服务器下发的恶意样本以及模型参数共同进行模型训练，从而缓解网关设备面临的恶意样本不足的问题，能通过更加丰富的恶意样本驱动检测模型的训练。因此，该方法能够提升模型训练的效果，从而有助于提升检测模型的性能，有助于降低利用检测模型检测报文流的误报率，有助于提升利用检测模型检测报文流的攻击覆盖率。
可选地，所述至少一条报文流包括第一报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：若所述第一报文流命中阻断规则，所述第一网关设备将所述第一报文流的元数据确定为所述恶意样本，所述阻断规则用于阻断恶意报文流。
上述提供了一种标定网关设备上恶意样本的技术手段。由于网关设备借助阻断规则从自身传输的报文流获取恶意样本，降低了获取恶意样本的复杂度，有助于恶意样本集合中的恶意样本更加丰富。
可选地，所述至少一条报文流包括第二报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：若所述第二报文流未命中阻断规则，所述第一网关设备将所述第二报文流的元数据输入模型训练之前的检测模型，所述阻断规则用于阻断恶意报文流，其中，当所述第一网关设备第一次执行所述模型训练时，所述模型训练之前的检测模型为初始检测模型；若所述模型训练之前的检测模型的输出结果指示所述第二报文流是可疑报文流，所述第一网关设备对所述第二报文流进行分析；若通过所述分析确定所述第二报文流是恶意报文流，所述第一网关设备将所述第二报文流的元数据确定为所述恶意样本。
以上提供了一种标定网关设备上恶意样本的技术手段。网关设备由于在报文流未命中阻断规则的情况下，结合模型以及本地分析这两种手段共同标定恶意样本，提高了恶意样本的精确度。
可选地，所述模型训练之前的检测模型的输出结果还指示所述第二报文流是恶意报文流的概率值，所述第一网关设备对所述第二报文流进行分析，包括：
若所述模型训练之前的检测模型的输出结果指示所述第二报文流是恶意报文流的概率值大于阈值，所述第一网关设备确定所述第二报文流是恶意报文流，所述概率值表示所述第二报文流是恶意报文流的可能性。
可选地，所述第一网关设备对所述第二报文流进行分析，包括：
若存在第一时间段内生成的域名生成算法DGA事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述第一时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述DGA事件中包括的事件源为第一主机，所述第一主机为所述第二报文流的源主机，所述DGA事件指示发生了所述第一主机访问DGA域名的行为。
可选地，所述第一网关设备对所述第二报文流进行分析，包括：若存在第二时间段内生成的内网暴力破解事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述第二时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述内网暴力破解事件指示发生了以第一主机所在的内网为目标的暴力破解攻击，所述第一主机为所述第二报文流的源主机；或者，若存在第二时间段内生成的敏感信息外泄事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述敏感信息外泄事件指示发生了所述第一主机上的敏感信息被发送至外网的行为；或者，若存在第二时间段内生成的外网分布式拒绝服务DDoS事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述外网DDoS事件指 示发生了所述第一主机所在的内网对外网发起的DDoS攻击。
可选地，所述第一网关设备对所述第二报文流进行分析，包括：若第三时间段内所述模型训练之前的检测模型针对目标报文流的元数据的输出结果呈现周期性，所述第一网关设备确定所述第二报文流是恶意报文流，所述第三时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述目标报文流包括以第一主机为源主机的至少一个报文流，所述第一主机为所述第二报文流的源主机。
以上为网关设备如何通过本地分析标定恶意样本提供了多种技术手段，有助于解决恶意样本难以获取的问题，帮助收集更多高质量的恶意样本。
可选地，所述至少一条报文流包括第三报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备将所述第三报文流的上下文信息发送至第二服务器，所述阻断规则用于阻断恶意报文流，所述上下文信息包括所述第三报文流的元数据或者所述第三报文流的数据包捕获PCAP报文中的至少一项；所述第一网关设备接收来自于所述第二服务器的根据所述上下文信息得到的分析结果；若所述分析结果指示所述第三报文流是恶意报文流，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本。
以上方法中，通过云端进行威胁分析来辅助网关设备标定恶意样本，降低了标定恶意样本的复杂度，有助于提高确定出的恶意样本的精确性。
可选地，所述至少一条报文流包括第三报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备根据所述第三报文流包括的目的互联网协议IP地址或所述第三报文流包括的源IP地址，查询第一威胁情报，所述第一威胁情报包括至少一个恶意IP地址；若所述目的IP地址或所述源IP地址命中所述第一威胁情报中的恶意IP地址，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本；或者，若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备根据所述第三报文流对应的目标域名，查询第二威胁情报，所述目标域名为所述第三报文流请求访问的域名，所述第二威胁情报包括至少一个恶意域名；若所述目标域名命中所述第二威胁情报中的恶意域名，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本；或者，若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备根据所述第三报文流对应的文件标识，查询第三威胁情报，所述文件标识用于标识所述第三报文流包括的文件，所述第三威胁情报包括至少一个恶意文件标识；若所述文件标识命中所述第三威胁情报中的恶意文件标识，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本。
以上方法中，通过借助威胁情报对报文流进行分析，有助于提升恶意样本标定的精确性。
可选地，所述第一网关设备从第一服务器获取第一模型参数之前，所述方法还包括：所述第一网关设备接收来自于所述第一服务器的所述共享样本和所述检测模型的超参数，所述超参数包括所述检测模型的学习率以及所述检测模型的初始参数，所述学习率用于控制所述第二模型参数与所述模型训练之前的检测模型的模型参数之间的差值，所述初始参数用于生成所述初始检测模型。
可选地，所述第一网关设备获取通过所述第一网关设备传输的至少一条报文流之后，所 述方法还包括：所述第一网关设备根据所述至少一条报文流获取正常样本集合，所述正常样本集合中包括的正常样本为所述至少一条报文流中正常报文流的元数据；所述第一网关设备根据所述恶意样本集合、共享样本和所述第一模型参数进行模型训练，包括：所述第一网关设备根据所述恶意样本集合、所述共享样本、所述第一模型参数和所述正常样本集合进行模型训练。
可选地，所述第一网关设备根据所述恶意样本集合、所述共享样本、所述第一模型参数和所述正常样本集合进行模型训练之前，所述方法还包括：如果第一正常样本在第四时间段的出现次数超过第一阈值，所述第一网关设备从所述正常样本集合中去除所述第一正常样本，所述第四时间段为所述第一网关设备获取到所述第一正常样本的时刻所属的历史时间周期；如果第一恶意样本在所述第五时间段的出现次数超过第二阈值，所述第一网关设备从所述恶意样本集合中去除所述第一恶意样本，所述第二阈值小于所述第一阈值，所述第五时间段为所述第一网关设备获取到所述第一恶意样本的时刻所属的历史时间周期。
以上方法有助于解决网关设备本地恶意样本与正常样本数量不均衡的问题，有助于第一网关设备本地的恶意样本与本地的正常样本尽可能的均衡。因此，避免模型由于难以学习到数量更少的一类样本包含的知识导致性能不佳，提升训练得到的检测模型的性能。
第二方面，提供了一种检测模型的训练方法，在该方法中，第一服务器接收来自于网关设备集合中的第一网关设备的第一模型参数，以及来自于所述网关设备集合中的第二网关设备的第二模型参数，所述第一模型参数是第一检测模型的参数，所述第一检测模型用于对通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述第二模型参数是第二检测模型的参数，所述第二检测模型用于对通过所述第二网关设备传输的报文流是否具有恶意性进行检测；所述第一服务器根据所述第一模型参数和所述第二模型参数进行汇聚处理，得到第三模型参数；所述第一服务器向所述网关设备集合中的至少一个网关设备发送所述第三模型参数。
在以上方法中，服务器通过接收各个网关设备上传的模型参数，对各个网关设备上传的模型参数进行汇聚处理，将汇聚处理后的模型参数下发给各个网关设备，以便网关设备利用汇聚处理后的模型参数进行模型训练，从而提升了网关设备模型训练的效果，进而提升了训练得到的检测模型的性能。
可选地，所述第一服务器根据所述第一模型参数和所述第二模型参数进行汇聚处理，得到第三模型参数，包括：所述第一服务器获取所述第一模型参数、所述第二模型参数的平均值；所述第一服务器根据所述平均值以及学习率，获取模型参数的变化量，所述变化量为所述平均值与所述学习率的乘积，所述学习率用于控制模型训练之后的检测模型的模型参数与模型训练之前的检测模型的模型参数之间的差值；所述第一服务器根据所述变化量对历史模型参数进行更新，得到所述第三模型参数，所述第三模型参数是所述历史模型参数与所述变化量之间的差值，所述历史模型参数是所述第一服务器在接收到所述第一模型参数和所述第二模型参数之前向所述网关设备集合中至少一个网关设备发送的模型参数。
可选地，所述第一服务器根据所述第一模型参数和所述第二模型参数进行汇聚处理之前，所述方法还包括：所述第一服务器确定参与联邦学习的网关设备集合；所述第一服务器向所述网关设备集合中的至少一个网关设备发送超参数以及共享样本，所述共享样本为所述服务器提供给网关设备集合中的各个网关设备的恶意样本，所述超参数包括初始参数以及学习率， 所述初始参数是所述第一检测模型以及所述第二检测模型的初始参数，所述学习率是所述第一检测模型以及所述第二检测模型的学习率。
可选地，所述第一服务器向所述网关设备集合中的的至少一个网关设备发送超参数以及共享样本之前，所述方法还包括：所述第一服务器在沙箱中运行恶意文件，得到至少一个数据包捕获PCAP报文；所述第一服务器根据所述至少一个PCAP报文，生成所述共享样本。
第三方面，提供了一种第一网关设备，该第一网关设备具有实现上述第一方面或第一方面任一种可选方式的功能。该第一网关设备包括至少一个模块，至少一个模块用于实现上述第一方面或第一方面任一种可选方式所提供的检测模型的训练方法。
在一些实施例中，第一网关设备中的模块通过软件实现，第一网关设备中的模块是程序模块。在另一些实施例中，第一网关设备中的模块通过硬件或固件实现。第三方面提供的第一网关设备的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第四方面，提供了一种第一服务器，该第一服务器具有实现上述第二方面或第二方面任一种可选方式的功能。该第一服务器包括至少一个模块，至少一个模块用于实现上述第二方面或第二方面任一种可选方式所提供的检测模型的训练方法。
在一些实施例中，第一服务器中的模块通过软件实现，第一服务器中的模块是程序模块。在另一些实施例中，第一服务器中的模块通过硬件或固件实现。第四方面提供的第一服务器的具体细节可参见上述第二方面或第二方面任一种可选方式，此处不再赘述。
第五方面，提供了一种第一网关设备，该第一网关设备包括网络接口、存储器和与所述存储器连接的处理器；
所述网络接口，用于获取通过所述第一网关设备传输的至少一条报文流；
所述存储器用于存储程序指令；
所述处理器用于执行所述程序指令，以使所述第一网关设备执行以下操作：
根据所述至少一条报文流获取恶意样本集合，所述恶意样本集合中包括的恶意样本为所述至少一条报文流中恶意报文流的元数据；从第一服务器获取第一模型参数；根据所述恶意样本集合、共享样本和所述第一模型参数进行模型训练，从而得到模型训练之后的检测模型，所述共享样本为所述第一服务器提供给网关设备集合中的各个网关设备的恶意样本，所述网关设备集合中包括所述第一网关设备，所述检测模型用于所述第一网关设备对后续通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述模型训练之后的检测模型具有第二模型参数；向所述第一服务器发送所述第二模型参数。
可选地，所述至少一条报文流包括第一报文流，所述处理器用于若所述第一报文流命中阻断规则，将所述第一报文流的元数据确定为所述恶意样本，所述阻断规则用于阻断恶意报文流。
可选地，所述至少一条报文流包括第二报文流，所述处理器用于若所述第二报文流未命中阻断规则，将所述第二报文流的元数据输入模型训练之前的检测模型，所述阻断规则用于阻断恶意报文流，其中，当所述第一网关设备第一次执行所述模型训练时，所述模型训练之前的检测模型为初始检测模型；若所述模型训练之前的检测模型的输出结果指示所述第二报文流是可疑报文流，对所述第二报文流进行分析；若通过所述分析确定所述第二报文流是恶意报文流，将所述第二报文流的元数据确定为所述恶意样本。
可选地，所述模型训练之前的检测模型的输出结果还指示所述第二报文流是恶意报文流 的概率值，所述处理器，用于若所述模型训练之前的检测模型的输出结果指示所述第二报文流是恶意报文流的概率值大于阈值，确定所述第二报文流是恶意报文流，所述概率值表示所述第二报文流是恶意报文流的可能性。
可选地，所述处理器，用于若存在第一时间段内生成的域名生成算法DGA事件，确定所述第二报文流是恶意报文流，所述第一时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述DGA事件中包括的事件源为第一主机，所述第一主机为所述第二报文流的源主机，所述DGA事件指示发生了所述第一主机访问DGA域名的行为。
可选地，所述处理器，用于若存在第二时间段内生成的内网暴力破解事件，确定所述第二报文流是恶意报文流，所述第二时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述内网暴力破解事件指示发生了以第一主机所在的内网为目标的暴力破解攻击，所述第一主机为所述第二报文流的源主机；或者，若存在第二时间段内生成的敏感信息外泄事件，确定所述第二报文流是恶意报文流，所述敏感信息外泄事件指示发生了所述第一主机上的敏感信息被发送至外网的行为；或者，若存在第二时间段内生成的外网分布式拒绝服务DDoS事件，确定所述第二报文流是恶意报文流，所述外网DDoS事件指示发生了所述第一主机所在的内网对外网发起的DDoS攻击。
可选地，所述处理器，用于若第三时间段内所述模型训练之前的检测模型针对目标报文流的元数据的输出结果呈现周期性，确定所述第二报文流是恶意报文流，所述第三时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述目标报文流包括以第一主机为源主机的至少一个报文流，所述第一主机为所述第二报文流的源主机。
可选地，所述至少一条报文流包括第三报文流，所述处理器，用于若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，将所述第三报文流的上下文信息发送至第二服务器，所述阻断规则用于阻断恶意报文流，所述上下文信息包括所述第三报文流的元数据或者所述第三报文流的数据包捕获PCAP报文中的至少一项；接收来自于所述第二服务器的根据所述上下文信息得到的分析结果；若所述分析结果指示所述第三报文流是恶意报文流，将所述第三报文流的元数据确定为所述恶意样本。
可选地，所述至少一条报文流包括第三报文流，所述处理器，用于若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，根据所述第三报文流包括的目的互联网协议IP地址或所述第三报文流包括的源IP地址，查询第一威胁情报，所述第一威胁情报包括至少一个恶意IP地址；若所述目的IP地址或所述源IP地址命中所述第一威胁情报中的恶意IP地址，将所述第三报文流的元数据确定为所述恶意样本；或者，若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，根据所述第三报文流对应的目标域名，查询第二威胁情报，所述目标域名为所述第三报文流请求访问的域名，所述第二威胁情报包括至少一个恶意域名；若所述目标域名命中所述第二威胁情报中的恶意域名，将所述第三报文流的元数据确定为所述恶意样本；或者，若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，根据所述第三报文流对应的文件标识，查询第三威胁情报，所述文件标识用于标识所述第三报文流包括的文件，所述第三威胁情报包括至少一个恶意文件标识；若所述文件标识命中所述第三威胁情报中的恶意文件标识，将所述第三报文流的元数据确定为所述恶意样本。
可选地，所述网络接口，用于接收来自于所述第一服务器的所述共享样本和所述检测模型的超参数，所述超参数包括所述检测模型的学习率以及所述检测模型的初始参数，所述学习率用于控制所述第二模型参数与所述模型训练之前的检测模型的模型参数之间的差值，所述初始参数用于生成所述初始检测模型。
可选地，所述处理器，还用于根据所述至少一条报文流获取正常样本集合，所述正常样本集合中包括的正常样本为所述至少一条报文流中正常报文流的元数据；根据所述恶意样本集合、所述共享样本、所述第一模型参数和所述正常样本集合进行模型训练。
可选地，所述处理器，还用于如果第一正常样本在第四时间段的出现次数超过第一阈值，从所述正常样本集合中去除所述第一正常样本，所述第四时间段为所述第一网关设备获取到所述第一正常样本的时刻所属的历史时间周期；如果第一恶意样本在所述第五时间段的出现次数超过第二阈值，从所述恶意样本集合中去除所述第一恶意样本，所述第二阈值小于所述第一阈值，所述第五时间段为所述第一网关设备获取到所述第一恶意样本的时刻所属的历史时间周期。
第六方面，提供了一种第一服务器，该第一服务器包括网络接口、存储器和与所述存储器连接的处理器，
所述网络接口，用于接收来自于网关设备集合中的第一网关设备的第一模型参数，以及来自于所述网关设备集合中的第二网关设备的第二模型参数，所述第一模型参数是第一检测模型的参数，所述第一检测模型用于对通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述第二模型参数是第二检测模型的参数，所述第二检测模型用于对通过所述第二网关设备传输的报文流是否具有恶意性进行检测；
所述存储器用于存储程序指令；
所述处理器用于执行所述程序指令，以使所述第一服务器执行以下操作：
根据所述第一模型参数和所述第二模型参数进行汇聚处理，得到第三模型参数；
向所述网关设备集合中的至少一个网关设备发送所述第三模型参数。
可选地，所述处理器，用于获取所述第一模型参数、所述第二模型参数的平均值；根据所述平均值以及学习率，获取模型参数的变化量，所述变化量为所述平均值与所述学习率的乘积，所述学习率用于控制模型训练之后的检测模型的模型参数与模型训练之前的检测模型的模型参数之间的差值；根据所述变化量对历史模型参数进行更新，得到所述第三模型参数，所述第三模型参数是所述历史模型参数与所述变化量之间的差值，所述历史模型参数是所述第一服务器在接收到所述第一模型参数和所述第二模型参数之前向所述网关设备集合中至少一个网关设备发送的模型参数。
可选地，所述处理器，还用于确定参与联邦学习的网关设备集合；向所述网关设备集合中的至少一个网关设备发送超参数以及共享样本，所述共享样本为所述服务器提供给网关设备集合中的各个网关设备的恶意样本，所述超参数包括初始参数以及学习率，所述初始参数是所述第一检测模型以及所述第二检测模型的初始参数，所述学习率是所述第一检测模型以及所述第二检测模型的学习率。
可选地，所述处理器，用于在沙箱中运行恶意文件，得到至少一个数据包捕获PCAP报文；根据所述至少一个PCAP报文，生成所述共享样本。
第七方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指 令由处理器读取以使第一网关设备执行上述第一方面或第一方面任一种可选方式所提供的检测模型的训练方法。
第八方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令由处理器读取以使第一服务器执行上述第二方面或第二方面任一种可选方式所提供的检测模型的训练方法。
第九方面，提供了一种计算机程序产品，该计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。第一网关设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该第一网关设备执行上述第一方面或第一方面任一种可选方式所提供的检测模型的训练方法。
第十方面，提供了一种计算机程序产品，该计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。第一服务器的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该第一服务器执行上述第二方面或第二方面任一种可选方式所提供的检测模型的训练方法。
第十一方面，提供了一种芯片，当该芯片在第一网关设备上运行时，使得第一网关设备执行上述第一方面或第一方面任一种可选方式所提供的检测模型的训练方法。
第十二方面，提供了一种芯片，当该芯片在第一服务器上运行时，使得第一服务器执行上述第二方面或第二方面任一种可选方式所提供的检测模型的训练方法。
第十三方面，提供了一种系统，该系统包括第一网关设备以及第一服务器，该第一网关设备用于执行上述第一方面或第一方面任一种可选方式所述的方法，该第一服务器用于执行上述第二方面或第二方面任一种可选方式所述的方法。
可选地，所述系统还包括第二服务器，所述第二服务器用于接收来自于所述网关设备的第三报文流的上下文信息，根据所述上下文信息进行分析，得到分析结果，向所述网关设备发送所述分析结果，所述上下文信息包括所述第三报文流的元数据或者所述第三报文流的数据包捕获PCAP报文中的至少一项，所述分析结果用于指示所述第三报文流是否为恶意报文流。
附图说明
图1是本申请实施例提供的一种系统架构100的示意图；
图2是本申请实施例提供的一种设备200的结构示意图；
图3是本申请实施例提供的一种CNN模型在模型训练阶段和模型应用阶段的示意图；
图4是本申请实施例提供的一种基于联邦学习训练检测模型的系统架构的示意图；
图5是本申请实施例提供的一种检测模型的训练方法的流程图；
图6是本申请实施例提供的一种训练检测模型时准确率的示意图；
图7是本申请实施例提供的一种系统架构的示意图；
图8是本申请实施例提供的一种网关设备本地分析的示意图；
图9是本申请实施例提供的一种云端分析的示意图；
图10是本申请实施例提供的一种检测模型的训练方法的流程图；
图11是本申请实施例提供的一种网关设备应用CNN模型检测报文流的示意图；
图12是本申请实施例提供的一种网关设备的结构示意图；
图13是本申请实施例提供的一种服务器的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
本申请实施例提供的方法能够应用在网络安全领域中基于AI检测报文流的场景。具体而言，本申请实施例的方法能够应用在防火墙使用检测模型检测报文流是否是恶意报文流的场景。下面先对检测恶意报文流的场景进行简单的介绍。
恶意报文流是指网络中传输的具有恶意性的报文流。恶意报文流通常由各种病毒、恶意爬虫、自动机、模拟器等生成。恶意报文流能够触发网络攻击、业务攻击、恶意爬虫等行为。例如，恶意报文流是用于触发命令和控制(command and control，C&C)攻击的超文本传输协议(hyper text transfer protocol，HTTP)报文流。为简明起见，下文将触发C&C攻击的HTTP报文流简称为C&C报文流。其中，C&C攻击是高级可持续威胁攻击(advanced persistent threat，APT)中的一个重要阶段。因此，恶意报文流的检测是安全威胁检测中至关重要的一个环节。
从Gartner(一家信息技术研究和分析的公司)的技术曲线图可以看出，人工智能(artificial intelligence，AI)在网络安全领域的应用已经进入成熟阶段，但业界使用AI进行安全威胁检测仍然存在两个难点问题需要解决。一个难点是，不同于视频领域，恶意报文流的数据具有难获取、难标定的特点，导致AI所需的恶意样本不足。另一个难点是，重视数据隐私和安全问题已经成了世界性趋势，很多企业出于隐私和安全性方面的考虑禁止本企业网的报文流数据被其他企业所分享。这就导致行业应用执行业务所产生的报文流的数据难收集，进一步造成AI所需的正常样本不足。由于样本的不足，影响了基于AI训练得到的模型的性能，无法保证模型低误报。
当前的安全网关设备如：下一代防火墙(next generation firewall，NGFW)、探针等已经基本上部署到各个企业的南北向出口、数据中心、分支互访节点处。而行业正常业务产生的报文流的数据、恶意报文流的数据等都存放在网关设备上。这导致形成一座座数据孤岛，无法全局汇聚生成AI模型。因此，如何在满足数据隐私、安全、监管要求的条件下，联合各方数据生成AI模型，部署到客户环境中准确发现更多的威胁是当前需要思考的问题。
传统解决如何获得样本的问题的思路分为以下三种。
思路一是，通过服务购买或者开源下载的方式来获取样本。例如，通过购买virustotal(一个免费的病毒、蠕虫、木马和各种恶意软件的分析服务，简称VT)的方式来获取恶意样本以及正常样本。但是，通过服务购买样本有以下三个问题。
问题1、一般恶意样本和正常样本不均衡。例如，恶意样本数量较多，行业应用样本等正常样本数量较少。
问题2、无法保证样本的时效性。
问题3、很多类型的恶意样本(如C&C报文流的恶意样本)，当前没有服务购买方式，也就无法得到这些类型的恶意样本。
思路二是，通过与友好厂商之间交换来获取样本。然而思路二存在的问题是，购买样本的价格比较昂贵，且一般无法保证交换样本的质量。
思路三是，通过云服务获取现网恶意样本。然而思路三存在的问题是，能够获取的恶意 样本数量非常有限。且，因为需要保证用户隐私，无法获取正常样本。
而本申请实施例中，通过借助联邦学习架构，由网关设备作为联邦学习的参与者，在云端部署联邦学习服务器，网关设备本地进行模型训练，云端的联邦学习服务器进行模型参数汇聚，从而解决数据孤岛问题。此外，对网关设备如何确定恶意样本以及如何解决联邦学习面临的恶意样本与正常样本数量不均衡问题方面进行了改进。
下面，按照系统架构、系统架构中各类设备的硬件结构、检测模型、模型训练侧的方法、模型应用侧的方法的顺序，从多个角度对本申请实施例提供的技术方案进行具体描述。
以下介绍本申请实施例提供的系统架构。
参见附图1，本申请实施例提供了一种系统架构100。系统架构100是对基于联邦学习架构训练检测模型的系统架构的举例说明。系统架构100主要包括两类节点，一类节点是参与联邦学习的多个网关设备，另一类节点是公有云。例如，如附图1所示，系统架构100包括参与联邦学习的网关设备110、参与联邦学习的网关设备111、参与联邦学习的网关设备112以及公有云120。网关设备110、网关设备111以及网关设备112分别与公有云120通过无线网络或有线网络相连。其中，本申请不对参与联邦学习的节点设备的数量和类型进行限制，网关设备110、网关设备111以及网关设备112是对参与联邦学习的多个网关设备的举例说明，例如参与联邦学习的设备还包括路由器、防火墙设备等等。
下面对多个参与联邦学习的网关设备以及公有云120分别进行介绍。
一、多个参与联邦学习的网关设备
网关设备用于对网络中传输的报文流进行威胁检测并充当联邦学习的参与者。可选地，网关设备还可以被替换为防火墙、入侵检测系统(intrusion detection system，IDS)类设备、入侵防御系统(intrusion prevention system，IPS)类设备、服务器、主机或个人计算机中的任一种设备。下面以网关设备110为例，对参与联邦学习的多个网关设备中的一个网关设备的举例说明。
网关设备110部署在企业网140与互联网之间。企业网140例如包括交换机1401、个人计算机1402、主机1403等设备。网关设备110与交换机1401相连，交换机1401与个人计算机1402、主机1403相连。交换机1401用于转发个人计算机1402、主机1403等设备与网关设备110之间传输的数据。
在网关设备110参与联邦学习的过程中，网关设备110会与公有云120交互各种信息。网关设备110与公有云120交互的信息包括模型参数、共享样本等。网关设备通过使用与公有云120交互的信息进行模型训练，得到检测模型1101。网关设备110通过检测模型1101，能够对通过网关设备110传输的报文流是否具有恶意性进行检测。例如，当网关设备110接收到企业网140与互联网之间传输的报文流时，网关设备110能通过检测模型1101对企业网140与互联网之间传输的报文流是否具有恶意性进行检测，从而为企业网140进行威胁检测，对企业网140进行安全防护。同理地，网关设备111通过与公有云120交互，训练得到检测模型1111；网关设备112通过与公有云120交互，训练得到检测模型1121。
在一些实施例中，参与联邦学习的不同网关设备分别部署在不同行业的企业网与互联网之间，以使不同网关设备能够将不同行业的数据作为样本参与模型训练。例如，网关设备110部署在金融行业或证券行业的企业网与互联网之间；或者，网关设备111部署在能源行业的企业网与互联网之间；网关设备112部署在政府网络与互联网之间；另外一些网关设备部署 在IoT行业的企业网与互联网之间中。
二、公有云
公有云120包括攻击知识库生产系统1201以及联邦学习服务器1202。攻击知识库生产系统1201与联邦学习服务器1202之间通过无线网络或有线网络相连。
攻击知识库生产系统1201用于在各种攻击场景下对恶意样本进行模拟、采集和管理。
攻击知识库生产系统1201例如为服务器、主机或个人计算机中的任一种。可选地，攻击知识库生产系统1201包括开源购买模块、沙箱培植模块、攻击模拟模块。开源购买模块用于用于支持网关设备购买开源的恶意样本。沙箱培植模块用于支持网关设备通过沙箱生成恶意样本。攻击模拟模块用于支持网关设备通过模拟网络攻击生成恶意样本。
联邦学习服务器1202用于管理联邦学习的各个参与者(即各个网关设备)、组织各个网关设备进行模型训练、将模型参数以及共享的恶意样本下发到联邦学习的各个参与者。
以上介绍了本申请实施例提供的系统架构，以下对上述系统架构中设备的硬件结构进行介绍。
请参见附图2，附图2所示的设备200是对上述系统架构中参与联邦学习的网关设备以及公有云的硬件结构的举例说明。可选地，设备200配置为网关设备110、网关设备111或者网关设备112。或者，可选地，设备200配置为联邦学习服务器1202或者攻击知识库生产系统120。设备200例如是主机、服务器或个人计算机等。
设备200可选地由一般性的总线体系结构来实现。设备200包括至少一个处理器201、通信总线202、存储器203以及至少一个网络接口204。
处理器201例如是通用中央处理器(central processing unit，CPU)、网络处理器(network processer，NP)、图形处理器(Graphics Processing Unit，GPU)、神经网络处理器(neural-network processing units，NPU)、数据处理单元(Data Processing Unit，DPU)、微处理器或者一个或多个用于实现本申请方案的集成电路。例如，处理器201包括专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。PLD例如是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线202用于在上述组件之间传送信息。通信总线202可以分为地址总线、数据总线、控制总线等。为便于表示，附图2中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器203例如是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，又如是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器203例如是独立存在，并通过通信总线202与处理器201相连接。存储器203也可以和处理器201集成在一起。
可选地，存储器203用于保存设备200执行模型训练得到的检测模型。当设备200需要使用检测模型时，处理器访问存储器203，得到存储器203中保存的检测模型。
网络接口204使用任何收发器一类的装置，用于与其它设备或通信网络通信。网络接口204包括有线网络接口，还可以包括无线网络接口。其中，有线网络接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线网络接口可以为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络网络接口或其组合等。
在具体实现中，作为一种实施例，处理器201可以包括一个或多个CPU，如附图2中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，设备200可以包括多个处理器，如附图2中所示的处理器201和处理器205。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，设备200还可以包括输出设备和输入设备。输出设备和处理器201通信，可以以多种方式来显示信息。例如，输出设备可以是液晶显示器(liquid crystal display，LCD)、发光二级管(light emitting diode，LED)显示设备、阴极射线管(cathode ray tube，CRT)显示设备或投影仪(projector)等。输入设备和处理器201通信，可以以多种方式接收用户的输入。例如，输入设备可以是鼠标、键盘、触摸屏设备或传感设备等。
在一些实施例中，存储器203用于存储执行本申请方案的程序代码210，处理器201可以执行存储器203中存储的程序代码210。也即是，设备200可以通过处理器201以及存储器203中的程序代码210，来实现方法实施例提供的检测模型的训练方法。
本申请实施例的设备200可对应于方法实施例中的第一网关设备、第一服务器或者第二服务器，并且，该设备200中的处理器201、网络接口204等可以实现上个方法实施例中的第一网关设备、第一服务器或者第二服务器所具有的功能和/或所实施的各种步骤和方法。为了简洁，在此不再赘述。
以上介绍了系统架构以及系统架构中设备的硬件结构，下面对本实施例提供的检测模型进行介绍。以下介绍的检测模型例如由上述系统架构以及上述系统架构中的设备训练得到。
检测模型用于对报文流是否具有恶意性进行检测。在本申请的一些实施例中，检测模型应用在网关设备检测通过自身传输的报文流的场景。检测模型例如为通过机器学习算法训练得到的AI模型。在一些实施例中，检测模型为通过监督学习算法训练得到的AI模型。例如，检测模型为卷积神经网络(convolutional neural networks，CNN)模型或者随机森林模型。在另一些实施例中，检测模型为通过非监督学习算法训练得到的AI模型。例如，检测模型为自编码器(auto encoder，AE)或者孤立森林模型。
检测模型的输入参数包括报文流的元数据(metadata)。报文流的元数据包括报文流的源IP地址、目的IP地址、源端口号、目的端口号、HTTP统一资源定位器(Uniform Resource Locator，URL)、用户代理(user agent，UA)字符串、发生时间或者持续时间中的至少一项。例如，检测模型为CNN模型，CNN模型的输入参数包括报文流中的HTTP元数据。HTTP元数据例如为报文流的HTTP URL以及user agent字符串。
检测模型的输出结果用于指示报文流是否具有恶意性。在一些实施例中，检测模型的输出结果包括报文流的类型。报文流的类型包括恶意报文流或者正常报文流。例如，当将报文 流的元数据输入检测模型后，如果检测模型输出1，表示报文流是恶意报文流。当将报文流的元数据输入检测模型后，如果检测模型输出0，表示报文流是正常报文流。在另一些实施例中，检测模型的输出结果包括报文流是恶意报文流的风险值或者概率值。
风险值用于表示报文流与恶意性的相关性。例如风险值越高，报文流的恶意性风险越高；或者风险值越低，报文流的恶意性风险越高。
概率值表示报文流是恶意报文流的可能性。概率值越大，表示报文流是恶意报文流的可能性越大。
此外，检测模型还具有超参数(hyper parameter)。检测模型的超参数包括检测模型的学习率以及检测模型的初始参数。
检测模型的学习率用于控制检测模型在相邻两次迭代之间模型参数的差值。学习率越小，损失函数的变化速度越慢，检测模型在相邻两次迭代之间模型参数的差值越大。例如，学习率用于控制第二模型参数与模型训练之前的检测模型的模型参数之间的差值。
检测模型的初始参数例如是检测模型在模型训练之前具有的模型参数。例如，检测模型是包括卷积核的CNN模型，初始参数为CNN模型中卷积核的初始权重。在模型训练的过程中，初始参数会随着训练的不断迭代而不断更新，从而逐渐逼近最优值。
以上介绍了本实施例提供的检测模型，下面从模型训练侧和模型应用侧对检测模型涉及的方法进行介绍。
以下介绍的检测模型的训练方法与应用检测模型检测报文流的方法是基于同一个构思产生的发明，或者理解为一个系统中的两个部分，或者理解为一个整体流程的两个阶段：如模型训练阶段和模型应用阶段。具体地，本申请实施例提供的检测模型的训练方法对训练数据(如本申请中的恶意样本和正常样本)进行符号化和形式化的智能信息建模、抽取、预处理、训练等，最终得到训练好的检测模型；本申请实施例提供的应用检测模型检测报文流的方法运用训练好的检测模型，将输入数据(如本申请中报文流的元数据)输入到训练好的检测模型中，得到输出数据(如报文流的类型或报文流是恶意报文流的概率)。例如，参见附图3，附图3是对CNN模型在模型训练阶段和模型应用阶段涉及的主要流程的举例说明。该CNN模型是对检测模型的举例说明。该CNN模型用于检测C&C报文流。在CNN模型的模型训练阶段，会对恶意样本中HTTP协议的关键字段进行提取，使用提取后的数据进行模型训练，得到CNN模型。在CNN模型的模型应用阶段，会对现网数据中HTTP协议的关键字段进行提取，使用提取后的数据输入训练好的CNN模型，得到输出数据。
本申请的一些实施例中，模型训练侧的方法采用联邦学习(federated learning，FL)技术实现。为了便于理解，下面先对联邦学习技术的概念进行介绍。
联邦学习是近年来一种新兴的人工智能技术。联邦学习主要用于解决AI算法在工业落地时所面临的数据孤岛问题。所谓数据孤岛问题是指，AI算法在工业应用时，往往面临高质量的样本不足、数据源的样本无法共享和数据隐私保护等问题，导致AI无法高效、准确地共同使用各自的样本。有鉴于此，业内提出了联邦学习技术来解决数据孤岛问题。联邦学习是一种分布式训练的方法。联邦学习的各参与方会借助其他方数据(如模型参数)训练各自的模型。联邦学习的各参与方在训练过程中无需共享数据资源，因此在样本不出本地的情况下，实现各联邦学习参与方的联合建模与利益共享。
本申请实施例将联邦学习应用在网络安全技术领域，通过采用联邦学习训练检测模型， 能够在样本不出网关设备本地的情况下，综合各个网关设备的数据一起模型训练，从而在确保网关设备数据隐私的基础上，提升模型训练的效果。
例如，参见附图4，附图4所示的系统400是对基于联邦学习训练检测模型的系统架构的举例说明。系统400例如通过系统100实现。系统400包括服务器以及n个网关设备。n表示正整数。
系统400中的服务器例如为系统100中的联邦学习服务器1202。
系统400中的n个网关设备分别为附图4所示的网关设备1、网关设备2、网关设备3…网关设备n。…表示附图4未示出而系统还可能包括的其他网关设备。网关设备1、网关设备2、网关设备3…网关设备n例如为附图1所示的网关设备111、网关设备112、网关设备113以及网关设备114。
网关设备与服务器在模型训练过程中扮演的角色有所区别。
网关设备充当联邦学习的参与者。网关设备主要负责恶意样本的标定并基于本地的恶意样本进行模型训练。样本标定通常是指为样本添加标签的过程。标签指示样本的类型。在本实施例中，样本的类型分为恶意样本和正常样本。恶意样本的标定例如是将一条报文流的元数据确定为恶意样本。恶意样本的标定包含检测一条报文流是恶意报文流还是正常报文流。网关设备负责标定的样本例如来自于网关设备自身传输的报文流。例如，网关设备1从网关设备1传输的报文流采集样本1。网关设备1将样本1保存在网关设备1本地。在联邦学习过程中，网关设备1使用样本1参与模型训练。同理地，网关设备2从网关设备2传输的报文流采集样本2。网关设备2将样本2保存在网关设备2本地。在联邦学习过程中，网关设备2使用样本2参与模型训练。依次类推，n个网关设备分别根据自身传输的报文流获得本地样本；n个网关设备分别使用本地样本参与模型训练。
服务器充当联邦学习的调度者。服务器主要负责对各个网关设备上的模型参数进行汇聚、向各个网关设备下发各种数据以及选择哪些网关设备参与联邦学习。
服务器与各个网关设备会在模型训练时传输各种数据。模型训练的不同阶段传输的数据有所区别。具体而言，模型训练包括初始化阶段以及n次迭代阶段。按照时间从先到后的顺序而言，模型训练依次是初始化阶段→第1次迭代→第2次迭代→……第t次迭代……→第n次迭代。n次迭代阶段每次迭代的原理类似。t表示当前迭代的索引，t为大于或等于1且小于或等于n的正整数。
下面，对初始化阶段以及n次迭代阶段网关设备与服务器分别交互哪些数据进行具体介绍。
在初始化阶段，服务器会选择哪些网关设备参与联邦学习。服务器选中参与联邦学习的网关设备后，服务器会将检测模型的超参数(如学习率、初始权重)以及共享样本下发到选中的各个网关设备中，使得检测模型的超参数以及共享样本同步至参与联邦学习的各个网关设备。
在第1次迭代时，参与联邦学习的各个网关设备会分别基于服务器下发的超参数、共享样本、本地的恶意样本以及本地的正常样本进行模型训练，得到第1次迭代的模型参数。各个网关设备会分别将各自得到的第1次迭代的模型参数上传至服务器。服务器接收各个网关设备上传的模型参数后，会对各个网关设备第1次迭代的模型参数进行汇聚，将汇聚后的模型参数下发给各个网关设备，使得汇聚后的模型参数同步至各个网关设备。其中，共享样本 例如由服务器在初始化阶段之前通过沙箱生成。
在第2次迭代时，参与联邦学习的各个网关设备会分别基于服务器下发的汇聚后的模型参数、共享样本、本地的恶意样本以及本地的正常样本进行模型训练，得到第2次迭代的模型参数。各个网关设备会分别将各自得到的第2次迭代的模型参数上传至服务器。服务器接收各个网关设备上传的模型参数后，会对各个网关设备第2次迭代的模型参数进行汇聚，将汇聚后的模型参数下发给各个网关设备，使得汇聚后的模型参数同步至各个网关设备。
通过执行n次迭代过程后，当服务器确定损失函数收敛或者检测模型的准确率达到准确率阈值时，服务器会停止模型训练过程。此时，模型训练过程结束，各个网关设备在本次迭代得到的模型参数为检测模型训练后的参数。
本实施例通过提供上述模型训练方法，由于每次迭代时，各个网关设备分别将模型参数上传给服务器，服务器对各个网关设备上的模型参数进行汇聚，将汇聚后的模型参数下发给各个网关设备，各个网关设备在下一次迭代时使用汇聚后的模型参数进行模型训练，使得各个网关设备模型训练时使用的数据更优，从而提升了模型训练的效果。下面，对达到提升模型训练这一技术效果的技术原理进行详细分析。
从数据的角度来看，如果采用本地学习的方式模型训练，模型训练只能单独使用一个网关设备上的数据。由于模型训练使用的数据不足，会严重影响模型的效果。而通过上述模型训练方法，由于各个网关设备上传的模型参数是由各个网关设备使用各自拥有的样本训练得到的，各个网关设备上传的模型参数能分别体现各个网关设备上样本包含的信息(如各个网关设备自身传输的报文流的特征)。因此，各个网关设备上传的模型参数经过汇聚后，汇聚后的模型参数能够综合体现各个网关设备上样本包含的信息，比单台网关设备本地学习的模型参数信息量更丰富。因此，各个网关设备通过使用汇聚后的模型参数进行模型训练，相当于各个网关设备借助其他网关设备上的数据来训练各自的检测模型。例如，网关设备1使用汇聚后的模型参数进行模型训练时，达到的效果类似于网关设备1借助网关设备2、网关设备3……网关设备n等其他参与联邦学习的网关设备的数据一起训练检测模型。由于模型训练使用的数据更多，显然能提升模型的效果。
值得说明的一点是，本实施例并不限定网关设备与服务器之间交互的数据是仅经过网关设备与服务器这两种设备，还是经过网关设备以及服务器之外的其他设备。在一些实施例中，网关设备与服务器之间还部署有一个或多个网络设备(如交换机、路由器等)，网关设备与服务器之间交互的数据是通过一个或多个网络设备转发的。换句话说，网关设备与服务器之间交互的数据所经过的路径可能是服务器→网关设备，也可能是服务器→一个或多个网络设备→网关设备，本实施例对网关设备与服务器在交互数据时如何传输数据不做限定。
以上介绍了基于联邦学习训练检测模型的整体构思，下面对具体如何基于联邦学习训练检测模型的方法进行举例说明。
以下，通过方法500和方法600分别从网关设备的角度以及服务器的角度对基于联邦学习训练检测模型的方法进行介绍。方法500是对参与联邦学习的一个网关设备执行的方法的举例说明。方法600是对参与联邦学习的服务器执行的方法的举例说明。
方法500和方法600中的第一网关设备和第二网关设备均是指参与联邦学习的一个网关设备。例如，第一网关设备是附图1所示系统架构100中网关设备110，第二网关设备是附图1所示系统架构100中网关设备111。例如，第一网关设备是附图4所示系统架构400中 网关设备1、网关设备2、网关设备3…网关设备n中的一个网关设备，第二网关设备是附图4所示系统架构400中网关设备1、网关设备2、网关设备3…网关设备n中除第一网关设备之外的另一个网关设备。
方法500和方法600中的第一服务器是指参与联邦学习的服务器。例如，第一服务器是附图1所示系统架构100中联邦学习服务器1202。例如，第一服务器是附图4所示系统架构400中的服务器。
可选地，方法500和方法600由通用中央处理器(central processing unit，CPU)处理。或者，方法500和方法600由CPU和一个或多个AI加速卡共同处理。例如，CPU和AI加速卡用于承担方法500和方法600不同步骤对应的处理工作。例如，AI加速卡承担方法500和方法600中模型训练对应的处理工作。CPU承担方法500和方法600中获取恶意样本对应的处理工作。其中，AI加速卡例如为图形处理器(graphics processing unit，GPU)、嵌入式神经网络处理器(neural-network processing units，NPU)、张量处理单元(tensor processing unit，TPU)或者其他为机器学习而定制的芯片。
方法500中的第二服务器例如是附图7所示系统架构中企业私有云130。方法500中的第二服务器与第一网关设备例如位于同一企业网中。
方法500和方法600中的恶意样本以及正常样本例如是网关设备本地维护的数据。例如，方法500中的恶意样本以及正常样本为附图7所示的数据库1104存储的数据。
方法500和方法600中的共享样本例如是服务器生成的数据。例如，方法500和方法600中的共享样本为附图1或附图7所示的攻击知识库生产系统1201生成的数据。
方法500和方法600中多处检测模型为检测C&C报文流的CNN模型为例进行说明。值得说明的一点是，本实施例并不限定检测模型的具体类型。在检测模型是其他类型的AI模型的情况下执行的方法与方法500和方法600同理。
方法500和方法600中多处以恶意报文流是C&C报文流、恶意样本是C&C报文流的元数据为例进行说明。值得说明的一点是，本实施例并不限定恶意报文流以及恶意样本的具体类型。换句话说，不限定网关设备利用触发哪种网络攻击的报文流的元数据进行模型训练，也不限定使用检测模型检测哪种类型的恶意报文流。
可选地，方法500和方法600中的第一网关设备、第二网关设备、第一服务器、第二服务器通过附图2所示的设备200实现。方法500和方法600中第一网关设备、第二网关设备、第一服务器或者第二服务器所实施的各种步骤通过设备200中的各硬件实现。例如，方法500和方法600各步骤通过设备200处理器201中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块例如位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质例如位于存储器210，处理器201读取存储器210中的信息，结合其硬件完成方法500和方法600的步骤。
参见附图5，附图5为方法500的流程图。方法500包括S510至S570。
S510、第一网关设备获取通过第一网关设备传输的至少一条报文流。
第一网关设备如何获取报文流包括多种方式。例如，第一网关设备部署在内网的出口处，第一网关设备接收内网中不同主机之间传输的报文流；或者，第一网关设备接收内网与外网 之间传输的报文流。例如，当内网的主机向外网设备发起访问时，内网的主机生成并发送报文流；报文流通过网络传输至第一网关设备；第一网关设备接收报文流。又如，当外网设备向内网的主机传输数据时，外网设备生成并发送报文流；报文流通过网络传输至第一网关设备；第一网关设备接收报文流。
第一网关设备得到报文流后，会根据得到的报文流来标定攻击样本以及正常样本。下面通过步骤S520，对如何标定攻击样本以及正常样本进行举例说明。
S520、第一网关设备根据至少一条报文流获取恶意样本集合以及正常样本集合。
样本为用于训练检测模型的数据。本实施例中，样本为报文流的元数据。
例如，一个样本是一条报文流的元数据。报文流的元数据是用于描述报文流的数据。例如，样本的类型分为恶意样本和正常样本。
恶意样本为恶意报文流的元数据。例如，一个恶意样本是一条恶意报文流的元数据。恶意样本也称黑样本或攻击样本。恶意样本集合包括至少一个恶意样本。
正常样本为正常报文流的元数据。例如，一个正常样本是一条正常报文流的元数据。正常样本也称白样本。正常样本集合包括至少一个正常样本。
第一网关设备如何获取恶意样本集合以及正常样本集合包括多种方式。例如，第一网关设备在至少一条报文流中识别至少一条恶意报文流以及至少一条正常报文流；第一网关设备获取至少一条恶意报文流中每个恶意报文流的元数据，第一网关设备将每个恶意报文流的元数据作为一个恶意样本，从而得到恶意样本集合；第一网关设备获取至少一条正常报文流中每个正常报文流的元数据，第一网关设备将每个正常报文流的元数据作为一个正常样本，从而得到正常样本集合。
可选地，第一网关设备执行S520之后，还执行以下S530。或者，可选地，第一网关设备执行S520之后，不执行以下S530，执行S540。
S530、第一网关设备对正常样本集合以及恶意样本集合进行筛选。
第一网关设备得到正常样本集合以及恶意样本集合之后，对正常样本集合以及恶意样本集合分别筛选，以便利用筛选后的样本进行模型训练。通过执行筛选样本的步骤，有助于解决网关设备本地恶意样本与正常样本数量不均衡的问题，有助于第一网关设备本地的恶意样本与本地的正常样本尽可能的均衡。因此，避免模型由于难以学习到数量更少的一类样本包含的知识导致性能不佳，提升训练得到的检测模型的性能。
其中，恶意样本与正常样本之间的均衡是指恶意样本与正常样本之间数量级差距不大。例如，恶意样本的数量与正常样本的数量之间的比值不小于比值阈值，比值阈值例如为1:100。换一种表达方式，假设恶意样本的数量为A，正常样本的数量为B，当A/B的取值范围在0.1-10之间时，叫做恶意样本与正常样本之间基本均衡。
第一网关设备如何筛选正常样本集合以及恶意样本集合包括多种方式。在一些实施例中，样本的筛选是根据样本在历史时间周期内的出现次数与阈值之间的数量关系确定的。第一网关设备会将历史时间周期内出现次数超过阈值的样本去除掉，并保留历史时间周期内出现次数不超过阈值的样本，从而实现样本的筛选。其中，历史时间周期的单位包括而不限于天、周、小时等。例如，历史时间周期为一天或多天。
在一些实施例中，筛选正常样本集合使用的阈值与筛选恶意样本集合时使用的阈值之间具有一定的数量关系。筛选正常样本集合使用的阈值大于筛选恶意样本集合时使用的阈值。 考虑到现网经常出现恶意样本少而正常样本多的情况，通过这一技术手段，由于筛选正常样本集合使用的阈值大，筛选恶意样本集合时使用的阈值小，能够减少正常样本的数量，增加恶意样本的数量，从而满足样本均衡的需求。在一些实施例中，筛选正常样本集合使用的阈值与筛选恶意样本集合时使用的阈值还根据网关设备的内存容量确定。例如，网关设备的内存容量越小，筛选正常样本集合使用的阈值与筛选恶意样本集合时使用的阈值越低，从而减少网关设备存储的样本数量，避免过多的样本占用网关设备有限的内存空间。
在一些实施例中，第一网关设备为恶意样本以及正常样本分别建立表。第一网关设备得到恶意样本以及正常样本之后，将恶意样本以及正常样本分别存储在对应的表中。第一网关设备通过查表来筛选正常样本集合以及恶意样本集合。其中，表采用键值的索引结构。表的键(key)是报文流的元数据。表的值(value)是样本在历史时间周期内出现次数。第一网关设备通过查表来筛选正常样本集合以及恶意样本集合。表例如存储在数据库中。
例如，网关设备在存储HTTP C&C恶意样本时，按照日期建立表。表的key是报文流的HTTP URL和user agent字符串。表的value是HTTP C&C恶意样本的当天出现个数。在一些实施例中，网关设备为HTTP C&C恶意样本最多建立30张表。30张表用于保存HTTP C&C恶意样本最近30天的数据。
例如，网关设备建立表black_http_cc_2020_05_01。表black_http_cc_2020_05_01代表针对HTTP C&C恶意样本5月1号的数据。表black_http_cc_2020_05_01的key为HTTP URL和user agent字符串。表black_http_cc_2020_05_01的value为key在2020年5月1号出现的次数。其中，网关设备建立多少个表根据网关设备的内存容量确定，30个表是对为恶意样本建立的表的数量的举例，7个表是对为正常样本建立的表的数量的举例，本实施例对网关设备建立的表的具体数量不做限定。
例如，网关设备在存储HTTP C&C正常样本时，按照日期建立表。表的key是报文流的HTTP URL和user agent字符串。表的value是HTTP C&C正常样本的当天出现个数。在一些实施例中，网关设备为HTTP C&C正常样本最多建立7张表。7张表用于保存HTTP C&C正常样本最近7天的数据。
例如，网关设备建立表white_http_cc_2020_05_01。表white_http_cc_2020_05_01代表针对HTTP C&C正常样本5月1号的数据。表white_http_cc_2020_05_01如下表1所示。
表1
Figure PCTCN2021089390-appb-000001
其中，表1的第1个表项中“http://thediscriminationlaws.com/”代表HTTP URL，“Java/1.7.0_161”代表user agent字符串，100代表查询表1时2020年5月1号该条HTTP URL和user agent字符串一共100个。表1的第2个表项中“http://tjv1.ejie.me/statistics/timestamp”代表HTTP URL，“Mozilla/5.0(Windows NT 10.0；Win64；x64；rv:65.0)Gecko/20100101Firefox/65.0”代表user agent字符串，200代表查询表1时2020年5月1号该条HTTP URL和user agent字符串一共200个。
在一些实施例中，第一网关设备获取第一正常样本在第四时间段的出现次数，第一网关 设备判断第一正常样本在第四时间段的出现次数是否超过第一阈值。如果第一正常样本在第四时间段的出现次数超过第一阈值，第一网关设备从正常样本集合中去除第一正常样本。其中，第一正常样本为正常样本集合中的一个正常样本。第四时间段为第一网关设备获取到第一正常样本的时刻所属的历史时间周期。
例如，网关设备处理正常样本的时间是2020年5月1号。网关设备将正常样本的http_url和user agent组合为http_url_user agent_white_sample。网关设备在表white_http_cc_2020_05_01中，查询http_url_user agent_white_sample对应的数量white_count。如果数量white_count超过阈值t1，则网关设备丢弃正常样本。如果数量white_count不超过阈值t1，网关设备更新表white_http_cc_2020_05_01中http_url_user agent_white_sample对应的数量white_count为white_count+1。
其中，2020年5月1号是对历史时间周期为一天时第四时间段的举例说明。阈值t1是对第一阈值的举例说明。阈值t1例如按照经验设置，阈值t1例如为10000。数量white_count是对第一正常样本在第四时间段的出现次数的举例说明。http_url_user agent_white_sample是对第一正常样本的举例说明。
在一些实施例中，第一网关设备获取第一恶意样本在第五时间段的出现次数，第一网关设备判断第一恶意样本在第五时间段的出现次数是否超过第二阈值。如果第一恶意样本在第五时间段的出现次数超过第二阈值，第一网关设备从恶意样本集合中去除第一恶意样本。其中，第二阈值小于第一阈值，第五时间段为第一网关设备获取到第一恶意样本的时刻所属的历史时间周期。
例如，网关设备处理恶意样本的时间是2020年5月1号。网关设备将恶意样本的http_url和user agent组合为http_url_user agent_black_sample。网关设备在表black_http_cc_2020_05_01中，查询http_url_user agent_black_sample对应的数量black_count。如果数量black_count超过阈值t2，则网关设备丢弃恶意样本。如果数量black_count不超过阈值t2，网关设备更新表black_http_cc_2020_05_01中http_url_user agent_black_sample对应的数量black_count为black_count+1。
其中，2020年5月1号是对历史时间周期为一天时第五时间段的举例说明。阈值t2是对第二阈值的举例说明。阈值t2例如按照经验设置，阈值t2例如为1000。数量black_count是对第一恶意样本在第五时间段的出现次数的举例说明。http_url_user agent_black_sample是对第一恶意样本的举例说明。
下面通过步骤S540，对网关设备在初始化阶段执行的步骤举例说明。通过步骤S550至步骤S570对网关设备在n次迭代中一次迭代执行的步骤举例说明。换句话说，步骤S540关于网关设备如何在初始化阶段得到来自于云端的恶意样本以及超参数，步骤S550至步骤S570关于网关设备如何在一次迭代中优化模型参数。
S540、第一网关设备接收来自于第一服务器的共享样本和检测模型的超参数。
共享样本为第一服务器提供给网关设备集合中的各个网关设备的恶意样本。共享样本例如为C&C流的元数据。例如，参见附图1或附图7，共享样本由公有云120的云端攻击知识库生产系统1201生成。共享样本由公有云120的联邦学习服务器1202下发给网关设备集合中的各个网关设备。
网关设备集合中包括第一网关设备以及其他参与联邦学习的网关设备。在一些实施例中， 第一服务器提供给网关设备集合中各个网关设备的共享样本是相同的。例如，网关设备集合包括网关设备1、网关设备2……网关设备i……网关设备n，第一服务器提供给网关设备1的共享样本、提供给网关设备2的共享样本、提供给网关设备n的共享样本是相同的。因此，网关设备1、网关设备2……网关设备i……网关设备n在参与模型训练时，网关设备1、网关设备2……网关设备i……网关设备n使用的共享样本是相同的。由于共享样本在模型训练时由各个网关设备共用，实现各个网关设备共享同一类恶意样本参与模型训练的功能。
云端通过将共享的恶意样本下发给网关设备，网关设备通过使用云端下发的恶意样本参与模型训练，一方面，有助于解决参与联邦学习的各个网关设备之间恶意样本不均衡的问题。例如，不同企业上的恶意样本一般会严重不均衡，导致企业的网关设备被选择为联邦学习的参与者之后会严重影响最终模型的效果。而云端通过将恶意样本下发给各个企业的网关设备，使得各个企业的网关设备均得到了来自云端的恶意样本，因此各个企业的网关设备的恶意样本会更加均衡。那么，由于不同网关设备基于更加均衡的恶意样本进行模型训练，显然有助于提高训练得到的模型模型的效果。另一方面，有助于缓解样本集合中恶意样本不足的问题，能够为检测模型的训练提供更加丰富的恶意样本。进一步地，由于通过更加丰富的恶意样本驱动模型训练，有助于提升检测模型的精确性。
超参数包括检测模型的学习率以及检测模型的初始参数。在一些实施例中，第一服务器提供给网关设备集合中各个网关设备的超参数是相同的，使得各个网关设备基于相同的超参数来训练各自的检测模型。
在一些实施例中，检测模型的初始参数和初始检测模型的初始参数是相同的。检测模型的初始参数用于生成初始检测模型。
以上通过步骤S540对模型训练的初始化阶段执行的步骤进行了说明。在一些实施例中，云端在初始化阶段下发一次共享样本，各个网关设备在本地保存云端发来的共享样本。在每一次迭代时，云端无需再次下发共享样本，各个网关设备使用预先保存的共享样本参与模型训练。
S550、第一网关设备从第一服务器获取第一模型参数。
例如，在n次迭代中的第t次迭代时，云端将检测模型在当前迭代的模型参数
Figure PCTCN2021089390-appb-000002
发送给参与联邦学习的每个网关设备。参与联邦学习的每个网关设备接收检测模型在当前迭代的模型参数
Figure PCTCN2021089390-appb-000003
其中，
Figure PCTCN2021089390-appb-000004
是对第一模型参数的举例说明。
Figure PCTCN2021089390-appb-000005
表示第t次迭代时的模型参数。其中，G例如表示权重，
Figure PCTCN2021089390-appb-000006
为第t次迭代时模型的权重。
S560、第一网关设备根据恶意样本集合、共享样本、第一模型参数和正常样本集合进行模型训练，从而得到模型训练之后的检测模型。
例如，参与联邦学习的每个网关设备使用本地的恶意样本、本地的正常样本以及云端下发的C&C流的元数据一起进行模型训练。在n次迭代中的第t次迭代时，网关设备i会更新本地的模型参数
Figure PCTCN2021089390-appb-000007
在一种可能的实现中，网关设备i通过最小化损失函数计算更新后的模型参数
Figure PCTCN2021089390-appb-000008
网关设备i将本地的模型参数
Figure PCTCN2021089390-appb-000009
更新为模型参数
Figure PCTCN2021089390-appb-000010
其中，
Figure PCTCN2021089390-appb-000011
表示网关设备i在第t次迭代时更新前的模型参数。
Figure PCTCN2021089390-appb-000012
表示网关设备i在第t次迭代时更新后的模型参数。网关设备i表示参与联邦学习的各个网关设备中的一个网关设备。网关设备i是对第一网关设备的举例说明。
在一些实施例中，网关设备i计算更新后的模型参数
Figure PCTCN2021089390-appb-000013
的步骤基于以下公式(1)实现。
Figure PCTCN2021089390-appb-000014
公式(1)中，
Figure PCTCN2021089390-appb-000015
表示损失函数。arg表示自变量(argument)。min表示最小值。argmin表示使
Figure PCTCN2021089390-appb-000016
达到最小值时自变量
Figure PCTCN2021089390-appb-000017
的取值。
S570、第一网关设备向第一服务器发送第二模型参数。
模型训练之后的检测模型具有第二模型参数。例如，在附图1所示的场景中，参与联邦学习的网关设备110得到更新后的模型参数
Figure PCTCN2021089390-appb-000018
后，网关设备110将更新后的模型参数
Figure PCTCN2021089390-appb-000019
发送给云端的联邦学习服务器1202。其中，
Figure PCTCN2021089390-appb-000020
是对第二模型参数的举例说明。
在n次迭代中，以上描述的网关设备从服务器获取模型参数、根据服务器下发的模型参数、本地的恶意样本集合、正常样本集合和共享样本进行模型训练，将训练得到的模型参数上报给服务器的步骤会一直重复执行，直至损失函数收敛或者准确率达到准确率阈值。准确率阈值例如为99％。
例如，参见附图6，附图6是对训练过程中准确率如何变化的举例说明。附图6的横坐标代表迭代的epoch(时期)。附图6的纵坐标代表准确率。附图6的曲线表示准确率与epoch之间的关系。一般情况下，准确率会随着epoch的增加而逐步递增。在一些实施例中，在模型训练过程中，准确率阈值为99％，当连续三个epoch的准确率都在99％以上时训练结束。
其中，epoch是指用训练集中的全部样本进行一次模型训练的过程。在本申请的一些实施例中，一个epoch是用恶意样本集合中的所有恶意样本以及正常样本集合中的所有正常样本训练一次检测模型的过程。例如，在检测模型是卷积神经网络的情况下，一个epoch是恶意样本集合中的所有恶意样本以及正常样本集合中的所有正常样本都在卷积神经网络中进行了一次正向传播和一次反向传播的过程。
本实施例提供的方法中，网关设备通过与服务器进行了交互，接收服务器下发的模型参数以及共享样本，网关设备使用服务器下发的模型参数、共享样本以及本地标定的恶意样本一起进行模型训练，从而提升了模型训练的效果，进而提升了训练得到的检测模型的性能。
以上对网关设备如何参与联邦学习的整体流程进行了介绍，下面对网关设备具体如何标定样本举例说明。
以下描述的附图7所示的系统架构是对上述附图1所示的系统架构100的举例说明。附图7不仅包含附图1所示的网关设备、公有云这两类节点，还包含标定恶意样本涉及的可选模块。
可选地，网关设备包括两个层次的威胁检测模块。参考附图7，第一层次的威胁检测模块包括规则系统以及检测模型。规则系统包括用于检测报文流的各种规则。规则系统具体包含阻断规则(如附图7所示的HTTP C&C阻断规则1102)以及非阻断规则。第二层次的威胁检测模块包括本地威胁判定模块(如附图7所示的HTTP C&C本地威胁判定模块1103)、云端威胁判定模块、云端人工判定模块以及本地人工判定模块。
本地威胁判定模块用于供网关设备在本地对报文流进行威胁检测。例如，可选地，本地威胁判定模块用于支持网关设备执行根据概率值是否大于阈值、是否存在域名生成算法(domain generation algorithm，DGA)事件、是否存在内网暴力破解事件、是否存在敏感信息外泄事件、是否存在外网分布式拒绝服务(distributed denial of service attack，DDoS)事件来判定报文流是否是恶意报文流的步骤。
可选地，云端威胁判定模块用于请求企业私有云130对报文流进行威胁检测，从而将本 地不能判定威胁的事件上送至云端进行威胁判定。例如，云端威胁判定模块用于支持网关设备执行将报文流的上下文信息发送给企业私有云130、接收企业私有云130的分析结果的步骤。
可选地，云端人工判定模块用于将报文流的信息通过网络提供给云端的运维团队，以便云端的运维团队人工对报文流进行威胁判定。
可选地，本地人工判定模块用于将报文流的信息输出给本地的运维团队，以便本地的运维团队人工对报文流进行威胁判定。
可选地，如附图7所示，系统架构还包括企业私有云130。
企业私有云130用于响应云端威胁判定模块的请求，辅助网关设备进行威胁分析。具体地，当网关设备本地难以判定威胁时，网关设备会将报文流的上下文信息上送给企业私有云130，企业私有云130会对报文流进行综合分析。企业私有云130通过分析判定报文流是否是恶意报文流后，企业私有云130会将分析结果返回给网关设备。
企业私有云130例如为服务器、主机或个人计算机中的任一种。企业私有云130包括关联分析确认模块、情报关联分析模块以及人工分析确认模块。关联分析确认模块的工作原理与本地威胁判定模块类似。情报关联分析模块用于借助威胁情报对报文流进行威胁判定。人工分析确认模块用于将报文流的信息提供给运维团队，由运维团队人工对报文流威胁判定。
可选地，企业私有云130与全球威胁情报中心1203以及APT高级威胁检测云服务1204之间通过无线网络或有线网络相连。全球威胁情报中心1203用于提供威胁情报。企业私有云130通过访问全球威胁情报中心1203，得到全球威胁情报中心1203提供的威胁情报。
可选地，APT高级威胁检测云服务1204用于检测APT高级威胁。企业私有云130能请求APT高级威胁检测云服务1204进一步检测报文流。
值得说明的一点是，附图7所示的系统100是对企业私有云130与网关设备110分离设置的举例说明。在另一些实施例中，企业私有云130与网关设备110物理上集成在一起，企业私有云130与网关设备110设置在同一硬件设备中。在企业私有云130与网关设备110集成时，企业私有云130包含的各个功能模块以及网关设备110包含的各个功能模块设置在同一硬件设备中。该硬件设备实现网关设备110对应的功能以及企业私有云130对应的功能，例如实现本地威胁判定模块对应的功能以及情报关联分析模块对应的功能。
以上结合附图7介绍了一些标定恶意样本涉及的可选模块和架构，以下对基于附图7所示架构标定恶意样本的方法流程举例说明。
在一些实施例中，第一网关设备标定恶意样本的具体实现方式包括以下方式一至方式三。换句话说，方式一至方式三描述了第一网关设备如何利用附图7所示架构标定恶意样本，从而利用恶意样本参与联邦学习。
方式一、第一网关设备基于阻断规则获取恶意样本。
阻断规则用于阻断恶意报文流。在一些实施例中，阻断规则指示恶意报文流与丢弃动作之间的对应关系。当报文流命中阻断规则时，表明报文流为恶意报文流，第一网关设备会按照阻断规则指示的丢弃动作，丢弃恶意报文流。因此，恶意报文流会在第一网关设备处传输中断，从而实现恶意报文流的阻断。
在一些实施例中，报文流命中阻断规则为报文流的元数据与阻断规则中的元数据满足匹配条件。例如，阻断规则包括条目A和条目B这两个条目。条目A包括恶意报文流的元数据， 例如互联网协议(internet protocol，IP)地址。条目B包括丢弃动作的标识(如“drop”、“deny”等)。第一网关设备会对报文流的元数据与条目A中元数据进行匹配，从而判断报文流的元数据与阻断规则中的元数据是否满足匹配条件。
其中，满足匹配条件包括多种情况。例如，满足匹配条件是指报文流的元数据与阻断规则中的元数据严格匹配，即报文流的元数据与阻断规则中的元数据相同。又如，满足匹配条件是指报文流的元数据与阻断规则中的元数据最长匹配。
本实施例对第一网关设备如何获得阻断规则不做限定。在一些实施例中，阻断规则预先保存在第一网关设备的存储器中。在另一些实施例中，阻断规则由服务器(如私有云服务器)下发给第一网关设备。
以针对第一报文流使用方式一为例，若第一报文流命中阻断规则，第一网关设备将第一报文流的元数据确定为恶意样本。其中，第一报文流为至少一条报文流中的一条报文流。例如，参见附图7，报文流进入网关设备后，如果报文流命中了HTTP C&C的阻断规则1102，则网关设备将报文流对应的元数据加入至恶意样本集合。其中，HTTP C&C的阻断规则1102是对阻断规则的举例说明。
上述方式一提供了一种标定网关设备上恶意样本的技术手段。由于网关设备借助阻断规则从自身传输的报文流获取恶意样本，降低了获取恶意样本的复杂度，有助于恶意样本集合中的恶意样本更加丰富。进一步地，由于为训练检测模型的工作提供了更加丰富的恶意样本，有助于通过更加丰富的恶意样本驱动模型训练，从而有助于提升检测模型的精确性。
方式二、第一网关设备基于模型训练之前的检测模型以及本地分析获取恶意样本。
在一些实施例中，第一网关设备每次进行模型训练时，通过本次模型训练之前的检测模型获取本次模型训练所需的恶意样本。
例如，联邦学习总共包括四次模型训练。第一网关设备在检测模型0的基础上第一次执行模型训练，使得检测模型0更新为检测模型1；第一网关设备在检测模型1的基础上第二次执行模型训练，使得检测模型1更新为检测模型2；第一网关设备在检测模型2的基础上第三次执行模型训练，使得检测模型2更新为检测模型3；第一网关设备在检测模型3的基础上第四次执行模型训练，使得检测模型3更新为检测模型4。
在这个场景中，例如，第一网关设备通过检测模型0标定恶意样本0，再根据恶意样本0第一次执行模型训练；第一网关设备通过检测模型1标定恶意样本1，再根据恶意样本1第二次执行模型训练；第一网关设备通过检测模型2标定恶意样本2，再根据恶意样本2第三次执行模型训练；第一网关设备通过检测模型3标定恶意样本3，再根据恶意样本3第四次执行模型训练。
其中，检测模型0是对初始检测模型的举例说明，恶意样本0例如通过检测模型0的输出结果确定。检测模型1是对第二次执行模型训练之前的检测模型的举例说明，恶意样本1例如通过检测模型1的输出结果确定。检测模型2是对第三次执行模型训练之前的检测模型的举例说明，恶意样本2例如通过检测模型2的输出结果确定。检测模型3是对第四次执行模型训练之前的检测模型的举例说明，恶意样本3例如通过检测模型3的输出结果确定。
其中，初始检测模型是指第一网关设备第一次执行模型训练时，模型训练之前的检测模型。一次模型训练的过程请参考上述S560等步骤的描述。初始检测模型与下述步骤得到的检测模型具有相同的网络架构，网络架构如模型具有哪些层以及不同层之间的连接关系。初始 检测模型与下述步骤得到的检测模型的模型参数可能具有区别，例如卷积核的权重可能不同。
在一些实施例中，初始检测模型的输出结果指示概率值。概率值表示第二报文流是恶意报文流的可能性，概率值越大，表示第二报文流是恶意报文流的可能性越大。通过概率值与阈值之间的数量关系，能够指明第二报文流是否是恶意报文流或者可疑报文流。例如，如果概率值小于阈值A，指示第二报文流是正常报文流；如果概率值大于或等于阈值A且小于阈值B，指示第二报文流是可疑报文流；如果概率值大于阈值B，指示第二报文流是恶意报文流。其中，阈值B大于阈值A。例如，阈值B为0.85，阈值A为0.5。
本地分析是指由第一网关设备对报文流进行分析的技术手段。在一些实施例中，第一网关设备在通过模型训练之前的检测模型发现可疑报文流的情况下，对可疑报文流继续进行本地分析，从而判定可疑报文流的元数据是否是恶意样本。
以针对第二报文流使用方式二为例，例如，若第二报文流未命中阻断规则，第一网关设备将第二报文流的元数据输入模型训练之前的检测模型；若模型训练之前的检测模型的输出结果指示第二报文流是可疑报文流，第一网关设备对第二报文流进行分析；若通过分析确定第二报文流是恶意报文流，第一网关设备将第二报文流的元数据确定为恶意样本。
报文流未命中阻断规则例如为报文流的元数据与阻断规则中的元数据不满足匹配条件。阻断规则以及匹配条件的介绍请参考上述方式一。
例如，参见附图8，如果报文流没有命中HTTP C&C的阻断规则1103，网关设备将HTTP元数据输入HTTP C&C的CNN模型。CNN模型会根据输入的HTTP元数据预测报文流是恶意报文流的概率值；如果CNN模型预测的概率值大于阈值，CNN模型上报可疑HTTP C&C事件；网关设备响应于可疑HTTP C&C事件，执行附图8所示的分析方法。
上述方式二提供了一种标定网关设备上恶意样本的技术手段。网关设备由于在报文流未命中阻断规则的情况下，结合模型以及本地分析这两种手段共同标定恶意样本，提高了恶意样本的精确度。
第一网关设备如何进行本地分析包括多种具体实现方式。下面通过方式(2-A)至方式(2-D)对本地分析的方式举例说明。
方式(2-A)第一网关设备根据模型训练之前的检测模型以及阈值进行本地分析。
具体地，若模型训练之前的检测模型的输出结果指示第二报文流是恶意报文流的概率值大于阈值，第一网关设备确定第二报文流是恶意报文流。例如，参见附图8，报文流进入CNN模型后，如果CNN模型预测的概率值超过0.85，CNN模型会上报威胁事件，报文流的元数据会进入恶意样本集合。其中，0.85是对阈值的举例说明。
方式(2-B)第一网关设备基于是否存在DGA事件进行本地分析。
具体地，第一网关设备判断是否存在第一时间段内生成的DGA事件；若存在第一时间段内生成的DGA事件，第一网关设备确定第二报文流是恶意报文流。
其中，第一时间段为以第一网关设备获取到第二报文流的时刻为结束点的历史时间段。例如，第一时间段为时长为5分钟的时间窗，该5分钟的时间窗的结束点为获取到第二报文流的时刻。DGA事件指示发生了第一主机访问DGA域名的行为。DGA事件中包括的事件源为第一主机。第一主机为第二报文流的源主机。例如，第二报文流的源IP地址为第一主机。DGA域名是指使用DGA算法生成的随机域名。DGA域名常用于触发僵尸网络或C&C等网络攻击行为。
例如，参见附图8，报文流的元数据进入网关设备后，网关设备会判断5分钟时间窗内主机(报文流的源主机)是否出现DGA事件；如果5分钟时间窗内主机出现DGA事件，则网关设备会判定存在威胁事件，网关设备将报文流的元数据加入恶意样本集合。
第一网关设备如何判断是否存在DGA事件包括多种方式。例如，第一网关设备在传输报文流的过程中，建立并保存访问记录。第一网关设备在进行本地分析时，查询访问记录。如果访问记录中记录有第一时间段内生成的DGA事件，则第一网关设备确定存在DGA事件。其中，访问记录用于指示报文流、攻击事件与攻击事件的生成时间之间的对应关系。例如，访问记录包括报文流的元数据、攻击事件的标识以及攻击事件的生成时间，第一网关设备以第二报文流的元数据以及第二时间段查询访问记录。
方式(2-C)第一网关设备基于是否存在内网暴力破解事件、敏感信息外泄事件或者外网DDoS事件进行本地分析。
具体地，第一网关设备判断是否存在第二时间段内生成的内网暴力破解事件、敏感信息外泄事件或者外网DDoS事件。若存在第二时间段内生成的内网暴力破解事件，第一网关设备确定第二报文流是恶意报文流；或者，若存在第二时间段内生成的敏感信息外泄事件，第一网关设备确定第二报文流是恶意报文流；或者，若存在第二时间段内生成的外网DDoS事件，第一网关设备确定第二报文流是恶意报文流。
其中，第二时间段为以第一网关设备获取到第二报文流的时刻为结束点的历史时间段。例如，第二时间段为时长为1天的时间窗，该时间窗的结束点为获取到第二报文流的时刻。
内网暴力破解事件指示发生了以第一主机所在的内网为目标的暴力破解攻击。敏感信息外泄事件指示发生了第一主机上的敏感信息被发送至外网的行为。第一主机上的敏感信息例如为用户名、密码等。外网DDoS事件指示发生了第一主机所在的内网对外网发起的DDoS攻击。第一主机为第二报文流的源主机。
例如，参见附图8，报文流的元数据进入网关设备后，网关设备会判断1天时间内主机(报文流的源主机)是否出现内网暴力破解事件、敏感信息外泄事件或者外网DDoS事件；如果1天时间内主机出现内网暴力破解事件、敏感信息外泄事件或者外网DDoS事件，则网关设备会判定存在威胁事件，网关设备将报文流的元数据加入至恶意样本集合。
方式(2-D)第一网关设备基于模型训练之前的检测模型的输出结果是否呈现周期性进行本地分析。
具体地，第一网关设备获取第三时间段内模型训练之前的检测模型针对目标报文流的元数据的输出结果，若第三时间段内模型训练之前的检测模型针对目标报文流的元数据的输出结果呈现周期性，第一网关设备确定第二报文流是恶意报文流。
其中，第三时间段为以第一网关设备获取到第二报文流的时刻为结束点的历史时间段。例如，第三时间段为时长为1天的时间窗，该时间窗的结束点为获取到第二报文流的时刻。目标报文流包括以第一主机为源主机的至少一个报文流。第一主机为第二报文流的源主机。
例如，参见附图8，报文流的元数据进入网关设备后，网关设备会判断CNN模型在1天时间内为主机(报文流的源主机)上报的HTTP C&C事件是否呈现周期性；如果CNN模型在1天时间内为主机上报的HTTP C&C事件呈现周期性，则网关设备会判定存在威胁事件，并将报文流的元数据加入恶意样本集合。
上述方式(2-A)至方式(2-D)为网关设备如何通过本地分析标定恶意样本提供了多种 技术手段，有助于解决恶意样本难以获取的问题，帮助收集更多高质量的恶意样本。
在一些实施例中，上述方式(2-A)至方式(2-D)所示的四种分析方式结合使用。例如，方式(2-A)至方式(2-D)所示四种分析方式中任一种分析方式指示第二报文流是恶意报文流时，第一网关设备将第二报文流的元数据确定为恶意样本。换句话说，方式(2-A)至方式(2-D)表达的四种判断条件以或的关系结合。上述方式(2-A)至方式(2-D)结合使用的方式可称为关联分析。
以上通过方式二介绍了第一网关设备如何进行本地分析。在一些实施例中，如果第一网关设备通过本地分析确定报文流不是恶意报文流，由运维人员对报文流采用人工分析的方式进一步分析。例如，第一网关设备提供全球广域网(world wide web，web)访问接口。如果分析出一条报文流不是恶意报文流，第一网关设备将报文流的元数据通过web访问接口提供给运维人员。运维人员对报文流进行人工分析。如果人工分析的结果为报文流是恶意报文流，第一网关设备将报文流的元数据加入恶意样本集合。如果人工分析的结果为报文流是正常报文流，第一网关设备将报文流的元数据加入正常样本集合。
在一些实施例中，第一网关设备还利用模型训练之前的检测模型来标定正常样本。例如，若报文流未命中阻断规则，第一网关设备将报文流的元数据输入模型训练之前的检测模型；若模型训练之前的检测模型的输出结果指示报文流不是可疑报文流，第一网关设备将报文流的元数据确定为正常样本。
例如，参见附图8，如果报文流没有命中HTTP C&C的阻断规则1102，网关设备将HTTP元数据输入HTTP C&C的CNN模型。CNN模型会根据输入的HTTP元数据预测报文流是恶意报文流的概率值；如果CNN模型预测的概率值小于阈值，CNN模型未上报可疑HTTP C&C事件，则这条报文流的元数据会加入至正常样本集合。
方式三、第一网关设备请求云端威胁分析从而得到恶意样本。
例如，参见附图7，如果报文流没有命中HTTP C&C的阻断规则1102，网关设备在难以确定报文流是否是恶意报文流的情况下，网关设备110将报文流的上下文信息上送给企业私有云130并请求企业私有云130进行威胁分析。响应于网关设备110的请求，企业私有云130根据报文流的上下文信息进行威胁分析。企业私有云130判定报文流为恶意报文流还是正常报文流，得到分析结果。企业私有云130将分析结果返回给网关设备110。网关设备110接收到来自于企业私有云130的分析结果之后，网关设备110会根据企业私有云130的分析结果判断报文流是恶意报文流还是正常报文流。如果网关设备110根据企业私有云130的分析结果发现报文流是恶意报文流，网关设备110会将恶意报文流的元数据加入至恶意样本集合。如果网关设备110根据企业私有云130的分析结果发现报文流是正常报文流，网关设备110会将正常报文流的元数据加入至正常样本集合。
具体地，若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第一网关设备将第三报文流的上下文信息发送至第二服务器；第二服务器接收来自于第一网关设备的第三报文流的上下文信息；第二服务器根据上下文信息进行分析，得到分析结果；第二服务器向第一网关设备发送分析结果。第一网关设备接收来自于第二服务器的根据上下文信息得到的分析结果；若分析结果指示第三报文流是恶意报文流，第一网关设备将第三报文流的元数据确定为恶意样本。
第三报文流是第一网关设备获取的至少一条报文流中的一条报文流。上下文信息包括第 三报文流的元数据或者第三报文流的数据包捕获(packet capture，PCAP)报文中的至少一项。
分析结果用于指示第三报文流是否为恶意报文流。例如，分析结果包括两种取值，一种取值指示第三报文流为恶意报文流，另一种取值指示第三报文流不为恶意报文流。
云端如何分析报文流是否是恶意报文流包括多种方式。在一些实施例中，云端借助威胁情报对报文流进行分析。
其中，威胁情报是关于互联网技术(internet technology，IT)或信息资产所面临的现有或潜在威胁的循证知识。威胁情报的内容包括恶意IP地址、正常IP地址、恶意域名、恶意文件标识中的至少一项。恶意IP地址和正常IP地址是两类IP地址。恶意IP地址的使用者执行了网络攻击等危害业务的恶意行为。恶意IP地址也称黑IP。正常IP地址是指正常用户使用的IP地址。正常IP地址也称白IP。恶意域名用于进行网络攻击行为。例如，恶意域名为恶意软件(如挖矿病毒、僵尸网络、勒索病毒等)实现被控制终端与控制服务器之间保持通信的域名。恶意文件标识用于标识恶意文件。例如，恶意文件标识为恶意文件的信息摘要算法(message-digest algorithm，MD5)码。
下面以云端为第二服务器为例，通过方式(3-A)至方式(3-C)对云端如何借助威胁情报进行分析举例说明。
方式(3-A)云端基于包含恶意IP地址的威胁情报分析。
例如，若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第二服务器根据第三报文流包括的目的IP地址或第三报文流包括的源IP地址，查询第一威胁情报；若目的IP地址或源IP地址命中第一威胁情报中的恶意IP地址，第二服务器将第三报文流是恶意报文流作为分析结果。若目的IP地址或源IP地址命中第一威胁情报中的正常IP地址，第二服务器将第三报文流不是恶意报文流作为分析结果。
其中，第一威胁情报包括至少一个恶意IP地址以及至少一个正常IP地址。
方式(3-B)云端基于包含恶意域名的威胁情报分析。
具体地，若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第二服务器根据第三报文流对应的目标域名，查询第二威胁情报；若目标域名命中第二威胁情报中的恶意域名，第二服务器将第三报文流是恶意报文流作为分析结果。若目标域名命中第二威胁情报中的正常域名，第二服务器将第三报文流不是恶意报文流作为分析结果。其中，第二威胁情报包括至少一个恶意域名以及至少一个正常域名。恶意域名也称黑域名，正常域名也称白域名。目标域名为第三报文流请求访问的域名。
方式(3-C)云端基于包含恶意文件标识的威胁情报分析。
具体地，若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第二服务器根据第三报文流对应的文件标识，查询第三威胁情报；若文件标识命中第三威胁情报中的恶意文件标识，第二服务器将第三报文流是恶意报文流作为分析结果。其中，第三威胁情报包括至少一个恶意文件标识。
在一些实施例中，云端不仅借助威胁情报对报文流进行分析，还采用与网关设备本地分析类似的方式对报文流进一步分析。例如，参见附图9，云端分析的过程具体包括下述方式(3-1)至方式(3-7)。
方式(3-1)云端查询报文流对应的威胁情报，如果通过查询威胁情报发现报文流是恶意报文流，则云端将报文流是恶意报文流作为分析结果。方式(3-1)的具体实现方式请参考上 述方式(3-A)至方式(3-C)。
方式(3-2)云端判断一天时间内主机(报文流的源主机)是否具有文件下载行为；如果一天时间内主机具有文件下载行为，云端从报文流中获取主机下载的文件；云端将文件送入云沙箱，通过云沙箱运行文件。如果云沙箱将文件判定为恶意文件，云端确定存在威胁事件，云端将报文流是恶意报文流作为分析结果。
方式(3-3)云端判断一天时间内报文流的源主机是否收到过钓鱼邮件；如果一天时间内报文流的源主机收到过钓鱼邮件，云端确定存在威胁事件，云端将报文流是恶意报文流作为分析结果。
方式(3-4)云端判断一周时间内报文流的源主机是否存在内网暴力破解事件、敏感信息外泄事件或者外网DDoS事件；如果一周时间内报文流的源主机存在内网暴力破解事件、敏感信息外泄事件或者外网DDoS事件，云端确定存在威胁事件，云端将报文流是恶意报文流作为分析结果。
方式(3-5)云端判断一周时间内CNN模型为报文流的源主机上报的HTTP C&C事件是否呈现周期性；如果一周时间内CNN模型为报文流的源主机上报的HTTP C&C事件呈现周期性，云端确定存在威胁事件，云端将报文流是恶意报文流作为分析结果。其中，方式(3-5)与上述方式(2-D)同理。
方式(3-6)云端判断包含报文流的多流AI模型是否上报威胁事件，如果多流AI模型上报威胁事件，则云端确定存在威胁事件，云端将报文流是恶意报文流作为分析结果。
方式(3-7)云端的运维团队对报文流进行人工分析。如果运维团队人工分析出报文流是恶意报文流，云端将报文流是恶意报文流作为分析结果。
在一些实施例中，上述方式(3-1)至方式(3-7)结合使用。例如，如果威胁等级高于阈值，当方式(3-1)至方式(3-7)中任一种方式指示报文流是恶意报文流时，第一网关设备将报文流的元数据确定为恶意样本。如果威胁等级低于阈值，当方式(3-1)至方式(3-7)中存在多种方式均指示报文流是恶意报文流时，第一网关设备将报文流的元数据确定为恶意样本。换句话说，方式(3-1)至方式(3-7)所示的7种条件以或的关系结合还是以且的关系结合根据威胁等级的高低确定，本实施例对此不做限定。
以上方式(3-1)至方式(3-7)为云端如何分析提供了多种实现方式。云端由于综合多种方式进行威胁判定，有助于提高确定出的恶意样本的精确性。
以上通过方式三介绍了云端威胁分析的过程。如果云端根据报文流判定出现威胁事件，报文流的元数据会进入恶意样本集合。如果方式(3-7)中的云端的运维团队人工分析出报文流是正常访问的报文流，报文流的元数据会进入正常样本集合。
在另一些实施例中，借助威胁情报进行分析的动作由网关设备本地执行。例如，网关设备与私有云服务器物理上集成在一起，网关设备具备查询威胁情报所需的性能以及存储容量，网关设备取代云端基于威胁情报进行恶意样本的标定。下面通过方式(3-a)至方式(3-c)对网关设备如何借助威胁情报进行分析举例说明。
方式(3-a)网关设备基于包含恶意IP地址的威胁情报分析。
例如，若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第一网关设备根据第三报文流包括的目的IP地址或第三报文流包括的源IP地址，查询第一威胁情报；若第三报文流包括的目的IP地址或第三报文流包括的源IP地址命中第一威胁情报中 的恶意IP地址，第一网关设备将第三报文流的元数据确定为恶意样本。
方式(3-b)网关设备基于包含恶意域名的威胁情报分析。
若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第一网关设备根据第三报文流对应的目标域名，查询第二威胁情报；若第三报文流对应的目标域名命中第二威胁情报中的恶意域名，第一网关设备将第三报文流的元数据确定为恶意样本。目标域名为第三报文流请求访问的域名，第二威胁情报包括至少一个恶意域名。
方式(3-c)网关设备基于包含恶意文件标识的威胁情报分析。
若第三报文流未命中阻断规则且通过分析确定第三报文流不是恶意报文流，第一网关设备根据第三报文流对应的文件标识，查询第三威胁情报；若第三报文流对应的文件标识命中第三威胁情报中的恶意文件标识，第一网关设备将第三报文流的元数据确定为恶意样本。其中，文件标识用于标识第三报文流包括的文件，第三威胁情报包括至少一个恶意文件标识。
在一些实施例中，上述方式一至方式三结合使用。可选地，方式一至方式三中两种或两种以上方式以或的关系结合。或者，可选地，方式一至方式三中两种或两种以上方式以且的关系结合。本实施例对这三种方式如何结合不做限定。以方式一和方式二以且的关系结合为例，例如，第一网关设备基于阻断规则、模型训练之前的检测模型以及本地分析获取恶意样本。
以上通过方法500从网关设备一侧对技术方案举例说明。以下通过方法600从服务器一侧对技术方案举例说明。换句话说，方法600关于服务器如何对参与联邦学习的网关设备上的模型参数进行汇聚。其中，方法600主要描述两个网关设备参与联邦学习时服务器执行的流程，体现服务器如何对两个网关设备上报的模型参数进行汇聚。在更多数量的网关设备参与联邦学习时，服务器执行的方法与此同理。
参见附图10，附图10为本申请实施例提供的一种检测模型的训练方法600的流程图。
示例性地，方法600包括S610至S660。
S610、第一服务器生成共享样本。
在一些实施例中，共享样本是通过沙箱生成的。例如，第一服务器在沙箱中运行恶意文件，得到至少一个PCAP报文；第一服务器根据至少一个PCAP报文，生成共享样本。例如，参见附图1或附图7，针对C&C报文流，攻击知识库生产系统1201从恶意报文流中挑选恶意PE样本。攻击知识库生产系统1201使用沙箱培植系统执行恶意PE样本，得到PCAP报文；攻击知识库生产系统1201将PCAP报文组成C&C报文流；在另一些实施例中，共享样本从友好企业中收集。例如，第一服务器从友好企业中收集的HTTP C&C威胁事件产生的数据，得到共享样本。
S620、第一服务器确定参与联邦学习的网关设备集合。
第一服务器将一些网关设备确定为联邦学习的参与者，调度这些网关设备进行模型训练。
第一服务器确定哪些网关设备参与联邦学习包括多种实现方式。在一些实施例中，第一服务器根据每个网关设备的计算能力、资源状态、通信带宽或数据质量中的至少一项，确定参与联邦学习的网关设备。例如，第一服务器根据模型训练对计算能力的需求，确定计算能力满足需求的网关设备。又如，第一服务器根据每个网关设备的资源利用率，确定资源利用率低于利用率阈值的网关设备。又如，第一服务器根据每个网关设备的通信带宽，确定通信带宽大于带宽阈值的网关设备。又如，第一服务器根据每个网关设备的数据质量，确定数据 质量高于质量阈值的网关设备。
S630、第一服务器向网关设备集合中的至少一个网关设备发送超参数以及共享样本。
例如，第一服务器定时(例如设置每个月一次)开启模型训练任务，将检测模型的超参数以及共享样本下发到选择的网关设备中。
其中，共享样本为服务器提供给网关设备集合中的各个网关设备的恶意样本，超参数包括初始参数以及学习率。
初始参数是第一检测模型以及第二检测模型的初始参数。学习率是第一检测模型以及第二检测模型的学习率。第一检测模型是指第一网关设备训练和应用的检测模型。第一检测模型用于对通过第一网关设备传输的报文流是否具有恶意性进行检测。第二检测模型是指第二网关设备训练和应用的检测模型。第二检测模型用于对通过第二网关设备传输的报文流是否具有恶意性进行检测。第一检测模型和第二检测模型具有相同的初始参数。例如，第一检测模型和第二检测模型具有相同的学习率。
S640、第一服务器接收来自于网关设备集合中的第一网关设备的第一模型参数，以及来自于网关设备集合中的第二网关设备的第二模型参数。
其中，网关设备集合包括第一网关设备和第二网关设备，可选地网关设备集合还包括除了第一网关设备、第二网关设备之外的其他网关设备。第一模型参数是第一检测模型的参数。第二模型参数是第二检测模型的参数。可选地，第一模型参数是第一检测模型的梯度值。第二模型参数是第二检测模型的梯度值。
S650、第一服务器根据第一模型参数和第二模型参数进行汇聚处理，得到第三模型参数。
在一些实施例中，汇聚处理的过程包括以下步骤一至步骤三。
步骤一、第一服务器获取第一模型参数、第二模型参数的平均值。
步骤二、第一服务器根据平均值以及学习率，获取模型参数的变化量。
例如，模型参数的变化量为模型参数的平均值与学习率的乘积。
步骤三、第一服务器根据变化量对历史模型参数进行更新，得到第三模型参数。
例如，第一服务器计算历史模型参数与模型参数的变化量之间的差值，将该差值作为第三模型参数。第三模型参数是历史模型参数与变化量之间的差值。历史模型参数是第一服务器在接收到第一模型参数和第二模型参数之前向网关设备集合中至少一个网关设备发送的模型参数。
S660、第一服务器向网关设备集合中的至少一个网关设备发送第三模型参数。
可选地，第一服务器向第一网关设备或者第二网关设备中的至少一项发送第三模型参数；或者，第一服务器向第一网关设备和第二网关设备之外其他的一个或多个网关设备发送第三模型参数。或者，第一服务器向网关设备集合中的全部网关设备发送第三模型参数。
以上步骤S640至步骤S660以两个网关设备参与联邦学习的情况为例，对服务器如何汇聚两个网关设备上报的模型参数举例说明。依次类推，上述步骤描述的方法流程能够应用在对更多数量的网关设备上报的模型参数进行汇聚的场景。下面对服务器如何汇聚n个网关设备上报的模型参数举例说明。其中，n为大于或等于2的正整数。
例如，在n次迭代中的第t次迭代时，当n个参与联邦学习的网关设备向服务器上报本地的模型参数后，服务器对n个网关设备上报的模型参数进行汇聚处理。具体地，服务器基于下述公式(2)和公式(3)，计算最小化本地损失函数，得到更新后的模型参数
Figure PCTCN2021089390-appb-000021
然后， 服务器将更新后的模型参数
Figure PCTCN2021089390-appb-000022
发送至n个网关设备，使得参与联邦学习的每个网关设备上的模型参数得到更新。
Figure PCTCN2021089390-appb-000023
Figure PCTCN2021089390-appb-000024
其中，w t+1表示对第t次迭代时汇聚处理得到的模型参数，或者说第t次迭代得到的更新后的模型参数。w t表示对第t次迭代时使用的历史模型参数。w t例如是第(t-1)次迭代时向网关设备发送的模型参数。
Figure PCTCN2021089390-appb-000025
为第t次迭代时模型参数的变化量。η表示学习率。
Figure PCTCN2021089390-appb-000026
表示模型参数的平均值。n表示参与联邦学习的网关设备的数量。k表示针对第k个参与联邦学习的网关设备进行计算。∑为求和符号。g k表示第k个参与联邦学习的网关设备计算的模型参数对本地数据的平均梯度。
Figure PCTCN2021089390-appb-000027
表示求梯度。L表示损失函数。
Figure PCTCN2021089390-appb-000028
表示第t次迭代时的模型参数。
Figure PCTCN2021089390-appb-000029
表示网关设备i在第t次迭代时更新前的模型参数。此外，公式(2)和公式(3)中
Figure PCTCN2021089390-appb-000030
公式(2)和公式(3)是对基于固定学习率的分布式梯度下降算法来更新模型参数的举例说明。公式(2)和公式(3)假设参与联邦学习的不同网关设备拥有的样本符合IID条件，参与联邦学习的不同网关设备拥有检测模型的初始参数，且参与联邦学习的每个网关设备了解优化器(如分布式梯度下降算法)的设定。
在n次迭代中，以上描述的接收各个网关设备发送的模型参数、对各个网关设备上的模型参数进行汇聚，将汇聚后的模型参数下发给各个网关设备的步骤会一直重复执行，直至损失函数收敛或者准确率达到准确率阈值。
本实施例提供的方法中，服务器通过接收各个网关设备上传的模型参数，对各个网关设备上传的模型参数进行汇聚处理，将汇聚处理后的模型参数下发给各个网关设备，以便网关设备利用汇聚处理后的模型参数进行模型训练，从而提升了网关设备模型训练的效果，进而提升了训练得到的检测模型的性能。
以上通过方法500和方法600介绍了模型训练侧的方法，以下对模型应用侧的方法进行介绍。
本实施例提供的检测模型用于网关设备对后续通过网关设备传输的报文流是否具有恶意性进行检测。例如，第一网关设备训练得到第一检测模型后，第一网关设备在保存第一检测模型。当第一网络设备后续接收到报文流时，第一网关设备提取报文流的元数据；第一网络设备将报文流的元数据输入第一检测模型，通过第一检测模型对报文流的元数据进行处理，输出报文流的类型或者报文流是恶意报文流的概率值。如果报文流的类型是恶意报文流或者报文流是恶意报文流的概率值大于阈值，第一网关设备判定报文流是恶意报文流。如果报文流的类型是正常报文流或者报文流是恶意报文流的概率值小于阈值，第一网关设备判定报文流是正常报文流。
下面，以检测模型为CNN模型为例，对具体如何应用检测模型检测报文流举例说明。
例如，参见附图11，网关设备应用CNN模型检测报文流的过程700包括以下步骤S710至步骤S760。其中，步骤S710至步骤S720关于网关设备如何对输入数据预处理。网关设备 通过步骤S710至步骤S720，能够将报文流的元数据的数据形式从字符串转换为矩阵，方便检测模型的卷积层对矩阵形式的元数据进行处理。步骤S710至步骤S720关于CNN模型内部的各个层对元数据依次执行的各种处理动作。可选地，步骤S710至步骤S720通过检测模型内置的某个层执行。或者，步骤S710至步骤S720通过与检测模型分离设置的预处理模块执行。
步骤S710、网关设备使用分割符号，对报文流的HTTP元数据进行单词分割，从而得到HTTP元数据包含的多个单词。
例如，分隔符号包含：‘(’，‘)’，‘{’，‘}’，‘/’，‘\’，‘@’，‘＝’等。例如，报文流的HTTP元数据为http://test.com/path/file？key＝pasword&get＝exploit.js，通过分割符号对HTTP元数据分割后，得到http test com path file key paS6word get exploit js。其中，http、test、com、path、file、key、paS6word、get、exploit、js均是对分割得到的单词的举例说明。
步骤S720、网关设备通过用来产生词向量的模型(word to vector，Word2vec)对各个单词分别向量化，从而得到矩阵。
矩阵包括多行。矩阵的每一行为一个向量，每个向量表示一个单词。
在一些实施例中，矩阵的行数预先设定为n。如果得到的单词数量超过n个，网关设备从得到的所有单词中选取前n个单词，网关设备对前n个单词分别向量化，从而得到n行的矩阵；如果得到的单词数量小于n个，网关设备对得到的全部单词分别向量化并进行补0，从而得到矩阵。例如，网关设备对http、test、com、path、file、key、paS6word、get、exploit、js分别向量化后，得到的矩阵包括n行d维。矩阵的第1行为表示http的d维向量；矩阵的第2行为表示test的d维向量；矩阵的第3行为表示com的d维向量，依次类推，矩阵的倒数第2行为表示exploit的d维向量，矩阵的最后1行为表示js的d维向量。
例如，参见附图11，网关设备执行步骤S720后得到矩阵Rn*d。矩阵Rn*d为n行d维的矩阵。d表示向量的维数。n表示矩阵的行数。
步骤S730、网关设备通过CNN模型的卷积层对矩阵进行卷积处理，得到报文流特征。
报文流特征为报文流的元数据指示的特征。报文流特征的形式例如为向量或者矩阵。
CNN模型的卷积层包括多个过滤器。每个过滤器的权重为一个矩阵。过滤器对应的矩阵的维数和步骤S720得到的矩阵的维数相同。例如，过滤器的权重为矩阵Rt*d。矩阵Rt*d是t行d维的矩阵。t＝3。卷积层包括的过滤器的数量例如为50。
步骤S740、网关设备通过CNN模型的池化层对报文流特征进行最大池化处理，得到池化后的特征。
步骤S750、网关设备通过CNN模型的全连接层对报文流特征进行线性映射和非线性映射，得到映射后的特征。
例如，线性映射和非线性映射通过线性整流函数(rectified linear unit，ReLU)或者其他激活函数实现。
步骤S760、网关设备通过CNN模型的输出层对映射后的特征进行分类，输出报文流的类型，报文流的类型为恶意报文流或者正常报文流。
以上介绍了本申请实施例的方法实施例，以下从逻辑功能的角度介绍本申请实施例的网关设备和服务器。
以下介绍的网关设备800具有上述方法500中第一网关设备的任意功能。
附图12示出了上述实施例中所涉及的第一网关设备的一种可能的结构示意图。附图12所示的网关设备800例如实现方法500中第一网关设备的功能。
请参考附图12，网关设备800包括获取模块801、训练模块802和发送模块803。网关设备800中的各个模块全部或部分地通过软件、硬件、固件或者其任意组合来实现。网关设备800中的各个模块用于执行上述方法500中第一网络设备的相应功能。具体地，获取模块801用于支持网关设备800执行S510、S520、S550。训练模块802用于支持网关设备800执行S560。发送模块803用于支持网关设备800执行S570。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可选地有另外的划分方式。
在一些实施例中，网关设备800中各个模块集成在一个模块中。例如，网关设备800中各个模块集成在同一个芯片上。该芯片包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口。训练模块802通过芯片中的处理电路实现。获取模块801通过芯片中的输入接口实现。发送模块803通过芯片中的输出接口实现。例如，该芯片通过一个或多个现场可编程门阵列(英文全称：field－programmable gate array，英文简称：FPGA)、可编程逻辑器件(英文全称：programmable logic device，英文简称：PLD)、控制器、状态机、门逻辑、分立硬件部件、任何其它适合的电路、或者能够执行本申请通篇所描述的各种功能的电路的任意组合实现。
在另一些实施例中，网关设备800各个模块单独物理存在。在另一些实施例中，网关设备800一部分模块单独物理存在，另一部分模块集成在一个模块中。
在网关设备800中通过硬件实现的情况下，网关设备800中训练模块802例如通过设备200中的处理器201实现。网关设备800中获取模块801、发送模块803例如通过设备200中的网络接口204实现。
在网关设备800中通过软件实现的情况下，网关设备800中各个模块例如为设备200中的处理器201读取存储器203中存储的程序代码210后生成的软件。例如，网关设备800为虚拟化设备。虚拟化设备包括而不限于虚拟机、容器、Pod中的至少一种。在一些实施例中，网关设备800以虚拟机的形式，部署在硬件设备(如物理服务器)上。例如，基于通用的物理服务器结合网络功能虚拟化(Network Functions Virtualization，NFV)技术来实现网关设备800。采用虚拟机的方式实现时，网关设备800例如为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出网关设备800。在另一些实施例中，网关设备800以容器(例如docker容器)的形式，部署在硬件设备上。例如，网关设备800执行上述方法实施例的流程被封装在镜像文件中，硬件设备通过运行镜像文件来创建网关设备800。在另一些实施例中，网关设备800以Pod的形式，部署在硬件设备上。Pod包括多个容器，每个容器用于实现网关设备800中的一个或多个模块。
以下介绍的服务器900具有上述方法700中第一服务器的任意功能。
附图13示出了上述实施例中所涉及的第一服务器的一种可能的结构示意图。附图13所示的服务器900例如实现方法700中第一服务器的功能。
请参考附图13，服务器900包括接收模块901、处理模块902和发送模块903。服务器900中的各个模块全部或部分地通过软件、硬件、固件或者其任意组合来实现。服务器900中的各个模块用于执行上述方法700中第一服务器的相应功能。具体地，接收模块901用于 支持服务器900执行S640。处理模块902用于支持服务器900执行S650。发送模块903用于支持服务器900执行S660。
可选地，接收模块901、处理模块902或发送模块903还用于支持服务器900执行本文所描述的技术中第一服务器执行的其它过程。例如，处理模块902还用于支持服务器900执行S610或S620。发送模块903还用于支持服务器900执行S660。服务器900具体执行过程请参考方法700中相应步骤的详细描述，这里不再一一赘述。
本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可选地有另外的划分方式。
在一些实施例中，服务器900中各个模块集成在一个处理模块中。例如，服务器900中各个模块集成在同一个芯片上。该芯片包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口。处理模块902通过芯片中的处理电路实现。接收模块901通过芯片中的输入接口实现。发送模块903通过芯片中的输出接口实现。例如，该芯片通过一个或多个现场可编程门阵列(英文全称：field－programmable gate array，英文简称：FPGA)、可编程逻辑器件(英文全称：programmable logic device，英文简称：PLD)、控制器、状态机、门逻辑、分立硬件部件、任何其它适合的电路、或者能够执行本申请通篇所描述的各种功能的电路的任意组合实现。
在另一些实施例中，服务器900各个模块单独物理存在。在另一些实施例中，服务器900一部分模块单独物理存在，另一部分模块集成在一个模块中。例如，在一些实施例中，处理模块902和发送模块903是同一个模块。在另一些实施例中，处理模块902和发送模块903是不同的模块。在一些实施例中，不同模块的集成采用硬件的形式实现，即，不同模块对应于同一个硬件。又如，不同模块的集成采用软件模块的形式实现。
在服务器900中通过硬件实现的情况下，服务器900中处理模块902例如通过设备200中的处理器201实现。服务器900中接收模块901、发送模块903例如通过设备200中的网络接口204实现。
在服务器900中通过软件实现的情况下，服务器900中各个模块例如为设备200中的处理器201读取存储器203中存储的程序代码210后生成的软件。例如，服务器900为虚拟化设备。虚拟化设备包括而不限于虚拟机、容器、Pod中的至少一种。在一些实施例中，服务器900以虚拟机的形式，部署在硬件设备(如物理服务器)上。例如，基于通用的物理服务器结合NFV技术来实现服务器900。采用虚拟机的方式实现时，服务器900例如为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出服务器900。在另一些实施例中，服务器900以容器(例如docker容器)的形式，部署在硬件设备上。例如，服务器900执行上述方法实施例的流程被封装在镜像文件中，硬件设备通过运行镜像文件来创建服务器900。在另一些实施例中，服务器900以Pod的形式，部署在硬件设备上。Pod包括多个容器，每个容器用于实现服务器900中的一个或多个模块。
在一些实施例中，提供了一种计算机程序产品，该计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。网关设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该网关设备执行方法500。
在一些实施例中，提供了一种计算机程序产品，该计算机程序产品包括计算机指令，该 计算机指令存储在计算机可读存储介质中。服务器的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该服务器执行方法600。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和模块的具体工作过程，可以参见前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，该模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或模块的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
该作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络模块上。可以根据实际的需要选择其中的部分或者全部模块来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以是两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件模块的形式实现。
该集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例中方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。例如，在不脱离各种示例的范围的情况下，第一网关设备可以被称为第二网关设备，并且类似地，第二网关设备可以被称为第一网关设备。第一网关设备和第二网关设备都可以是网关设备，并且在某些情况下，可以是单独且不同的网关设备。
本申请中术语“至少一个”的含义是指一个或多个，本申请中术语“多个”的含义是指两个或两个以上，本文中术语“系统”和“网络”经常可互换使用。
还应理解，术语“如果”可被解释为意指“当...时”(“when”或“upon”)或“响应于确定”或“响 应于检测到”。类似地，根据上下文，短语“如果确定...”或“如果检测到[所陈述的条件或事件]”可被解释为意指“在确定...时”或“响应于确定...”或“在检测到[所陈述的条件或事件]时”或“响应于检测到[所陈述的条件或事件]”。
以上描述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。
该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (38)

  1. 一种检测模型的训练方法，其特征在于，所述方法包括：
    第一网关设备获取通过所述第一网关设备传输的至少一条报文流；
    所述第一网关设备根据所述至少一条报文流获取恶意样本集合，所述恶意样本集合中包括的恶意样本为所述至少一条报文流中恶意报文流的元数据；
    所述第一网关设备从第一服务器获取第一模型参数；
    所述第一网关设备根据所述恶意样本集合、共享样本和所述第一模型参数进行模型训练，从而得到模型训练之后的检测模型，所述共享样本为所述第一服务器提供给网关设备集合中的各个网关设备的恶意样本，所述网关设备集合中包括所述第一网关设备，所述检测模型用于所述第一网关设备对后续通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述模型训练之后的检测模型具有第二模型参数；
    所述第一网关设备向所述第一服务器发送所述第二模型参数。
  2. 根据权利要求1所述的方法，其特征在于，所述至少一条报文流包括第一报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：
    若所述第一报文流命中阻断规则，所述第一网关设备将所述第一报文流的元数据确定为所述恶意样本，所述阻断规则用于阻断恶意报文流。
  3. 根据权利要求1所述的方法，其特征在于，所述至少一条报文流包括第二报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：
    若所述第二报文流未命中阻断规则，所述第一网关设备将所述第二报文流的元数据输入模型训练之前的检测模型，所述阻断规则用于阻断恶意报文流，其中，当所述第一网关设备第一次执行所述模型训练时，所述模型训练之前的检测模型为初始检测模型；
    若所述模型训练之前的检测模型的输出结果指示所述第二报文流是可疑报文流，所述第一网关设备对所述第二报文流进行分析；
    若通过所述分析确定所述第二报文流是恶意报文流，所述第一网关设备将所述第二报文流的元数据确定为所述恶意样本。
  4. 根据权利要求3所述的方法，其特征在于，所述模型训练之前的检测模型的输出结果还指示所述第二报文流是恶意报文流的概率值，所述第一网关设备对所述第二报文流进行分析，包括：
    若所述模型训练之前的检测模型的输出结果指示所述第二报文流是恶意报文流的概率值大于阈值，所述第一网关设备确定所述第二报文流是恶意报文流，所述概率值表示所述第二报文流是恶意报文流的可能性。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第一网关设备对所述第二报文流进行分析，包括：
    若存在第一时间段内生成的域名生成算法DGA事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述第一时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述DGA事件中包括的事件源为第一主机，所述第一主机为所述第二报文流的源主机，所述DGA事件指示发生了所述第一主机访问DGA域名的行为。
  6. 根据权利要求3或4所述的方法，其特征在于，所述第一网关设备对所述第二报文流进行分析，包括：
    若存在第二时间段内生成的内网暴力破解事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述第二时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述内网暴力破解事件指示发生了以第一主机所在的内网为目标的暴力破解攻击，所述第一主机为所述第二报文流的源主机；或者，
    若存在第二时间段内生成的敏感信息外泄事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述敏感信息外泄事件指示发生了所述第一主机上的敏感信息被发送至外网的行为；或者，
    若存在第二时间段内生成的外网分布式拒绝服务DDoS事件，所述第一网关设备确定所述第二报文流是恶意报文流，所述外网DDoS事件指示发生了所述第一主机所在的内网对外网发起的DDoS攻击。
  7. 根据权利要求3或4所述的方法，其特征在于，所述第一网关设备对所述第二报文流进行分析，包括：
    若第三时间段内所述模型训练之前的检测模型针对目标报文流的元数据的输出结果呈现周期性，所述第一网关设备确定所述第二报文流是恶意报文流，所述第三时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述目标报文流包括以第一主机为源主机的至少一个报文流，所述第一主机为所述第二报文流的源主机。
  8. 根据权利要求1所述的方法，其特征在于，所述至少一条报文流包括第三报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：
    若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备将所述第三报文流的上下文信息发送至第二服务器，所述阻断规则用于阻断恶意报文流，所述上下文信息包括所述第三报文流的元数据或者所述第三报文流的数据包捕获PCAP报文中的至少一项；
    所述第一网关设备接收来自于所述第二服务器的根据所述上下文信息得到的分析结果；
    若所述分析结果指示所述第三报文流是恶意报文流，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本。
  9. 根据权利要求1所述的方法，其特征在于，所述至少一条报文流包括第三报文流，所述第一网关设备根据所述至少一条报文流获取恶意样本集合，包括：
    若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备根据所述第三报文流包括的目的互联网协议IP地址或所述第三报文流包括的 源IP地址，查询第一威胁情报，所述第一威胁情报包括至少一个恶意IP地址；若所述目的IP地址或所述源IP地址命中所述第一威胁情报中的恶意IP地址，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本；或者，
    若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备根据所述第三报文流对应的目标域名，查询第二威胁情报，所述目标域名为所述第三报文流请求访问的域名，所述第二威胁情报包括至少一个恶意域名；若所述目标域名命中所述第二威胁情报中的恶意域名，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本；或者，
    若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，所述第一网关设备根据所述第三报文流对应的文件标识，查询第三威胁情报，所述文件标识用于标识所述第三报文流包括的文件，所述第三威胁情报包括至少一个恶意文件标识；若所述文件标识命中所述第三威胁情报中的恶意文件标识，所述第一网关设备将所述第三报文流的元数据确定为所述恶意样本。
  10. 根据权利要求3至8中任一项所述的方法，其特征在于，所述第一网关设备从第一服务器获取第一模型参数之前，所述方法还包括：
    所述第一网关设备接收来自于所述第一服务器的所述共享样本和所述检测模型的超参数，所述超参数包括所述检测模型的学习率以及所述检测模型的初始参数，所述学习率用于控制所述第二模型参数与所述模型训练之前的检测模型的模型参数之间的差值，所述初始参数用于生成所述初始检测模型。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，所述第一网关设备获取通过所述第一网关设备传输的至少一条报文流之后，所述方法还包括：
    所述第一网关设备根据所述至少一条报文流获取正常样本集合，所述正常样本集合中包括的正常样本为所述至少一条报文流中正常报文流的元数据；
    所述第一网关设备根据所述恶意样本集合、共享样本和所述第一模型参数进行模型训练，包括：
    所述第一网关设备根据所述恶意样本集合、所述共享样本、所述第一模型参数和所述正常样本集合进行模型训练。
  12. 根据权利要求11所述的方法，其特征在于，所述第一网关设备根据所述恶意样本集合、所述共享样本、所述第一模型参数和所述正常样本集合进行模型训练之前，所述方法还包括：
    如果第一正常样本在第四时间段的出现次数超过第一阈值，所述第一网关设备从所述正常样本集合中去除所述第一正常样本，所述第四时间段为所述第一网关设备获取到所述第一正常样本的时刻所属的历史时间周期；
    如果第一恶意样本在所述第五时间段的出现次数超过第二阈值，所述第一网关设备从所述恶意样本集合中去除所述第一恶意样本，所述第二阈值小于所述第一阈值，所述第五时间段为所述第一网关设备获取到所述第一恶意样本的时刻所属的历史时间周期。
  13. 一种检测模型的训练方法，其特征在于，所述方法包括：
    第一服务器接收来自于网关设备集合中的第一网关设备的第一模型参数，以及来自于所述网关设备集合中的第二网关设备的第二模型参数，所述第一模型参数是第一检测模型的参数，所述第一检测模型用于对通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述第二模型参数是第二检测模型的参数，所述第二检测模型用于对通过所述第二网关设备传输的报文流是否具有恶意性进行检测；
    所述第一服务器根据所述第一模型参数和所述第二模型参数进行汇聚处理，得到第三模型参数；
    所述第一服务器向所述网关设备集合中的至少一个网关设备发送所述第三模型参数。
  14. 根据权利要求13所述的方法，其特征在于，所述第一服务器根据所述第一模型参数和所述第二模型参数进行汇聚处理，得到第三模型参数，包括：
    所述第一服务器获取所述第一模型参数、所述第二模型参数的平均值；
    所述第一服务器根据所述平均值以及学习率，获取模型参数的变化量，所述变化量为所述平均值与所述学习率的乘积，所述学习率用于控制模型训练之后的检测模型的模型参数与模型训练之前的检测模型的模型参数之间的差值；
    所述第一服务器根据所述变化量对历史模型参数进行更新，得到所述第三模型参数，所述第三模型参数是所述历史模型参数与所述变化量之间的差值，所述历史模型参数是所述第一服务器在接收到所述第一模型参数和所述第二模型参数之前向所述网关设备集合中至少一个网关设备发送的模型参数。
  15. 根据权利要求13所述的方法，其特征在于，所述第一服务器根据所述第一模型参数和所述第二模型参数进行汇聚处理之前，所述方法还包括：
    所述第一服务器确定参与联邦学习的网关设备集合；
    所述第一服务器向所述网关设备集合中的至少一个网关设备发送超参数以及共享样本，所述共享样本为所述服务器提供给网关设备集合中的各个网关设备的恶意样本，所述超参数包括初始参数以及学习率，所述初始参数是所述第一检测模型以及所述第二检测模型的初始参数，所述学习率是所述第一检测模型以及所述第二检测模型的学习率。
  16. 根据权利要求15所述的方法，其特征在于，所述第一服务器向所述网关设备集合中的的至少一个网关设备发送超参数以及共享样本之前，所述方法还包括：
    所述第一服务器在沙箱中运行恶意文件，得到至少一个数据包捕获PCAP报文；
    所述第一服务器根据所述至少一个PCAP报文，生成所述共享样本。
  17. 一种系统，其特征在于，所述系统包括网关设备以及第一服务器，所述网关设备用于执行如权利要求1至权利要求12中任一项所述的方法，所述第一服务器用于执行如权利要求13至权利要求16中任一项所述的方法。
  18. 根据权利要求17所述的系统，其特征在于，所述系统还包括第二服务器，所述第二服务器用于接收来自于所述网关设备的第三报文流的上下文信息，根据所述上下文信息进行分析，得到分析结果，向所述网关设备发送所述分析结果，所述上下文信息包括所述第三报文流的元数据或者所述第三报文流的数据包捕获PCAP报文中的至少一项，所述分析结果用于指示所述第三报文流是否为恶意报文流。
  19. 一种第一网关设备，其特征在于，所述网关设备包括：
    获取模块，用于获取通过所述第一网关设备传输的至少一条报文流；
    所述获取模块，还用于根据所述至少一条报文流获取恶意样本集合，所述恶意样本集合中包括的恶意样本为所述至少一条报文流中恶意报文流的元数据；
    所述获取模块，还用于从第一服务器获取第一模型参数；
    训练模块，用于根据所述恶意样本集合、共享样本和所述第一模型参数进行模型训练，从而得到模型训练之后的检测模型，所述共享样本为所述第一服务器提供给网关设备集合中的各个网关设备的恶意样本，所述网关设备集合中包括所述第一网关设备，所述检测模型用于所述第一网关设备对后续通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述模型训练之后的检测模型具有第二模型参数；
    发送模块，用于向所述第一服务器发送所述第二模型参数。
  20. 根据权利要求19所述的网关设备，其特征在于，所述至少一条报文流包括第一报文流，所述获取模块，用于若所述第一报文流命中阻断规则，将所述第一报文流的元数据确定为所述恶意样本，所述阻断规则用于阻断恶意报文流。
  21. 根据权利要求19所述的网关设备，其特征在于，所述至少一条报文流包括第二报文流，所述获取模块，用于若所述第二报文流未命中阻断规则，将所述第二报文流的元数据输入模型训练之前的检测模型，所述阻断规则用于阻断恶意报文流，其中，当所述第一网关设备第一次执行所述模型训练时，所述模型训练之前的检测模型为初始检测模型；若所述模型训练之前的检测模型的输出结果指示所述第二报文流是可疑报文流，对所述第二报文流进行分析；若通过所述分析确定所述第二报文流是恶意报文流，将所述第二报文流的元数据确定为所述恶意样本。
  22. 根据权利要求21所述的网关设备，其特征在于，所述模型训练之前的检测模型的输出结果还指示所述第二报文流是恶意报文流的概率值，所述获取模块，用于若所述模型训练之前的检测模型的输出结果指示所述第二报文流是恶意报文流的概率值大于阈值，确定所述第二报文流是恶意报文流，所述概率值表示所述第二报文流是恶意报文流的可能性。
  23. 根据权利要求21或22所述的网关设备，其特征在于，所述获取模块，用于若存在第一时间段内生成的域名生成算法DGA事件，确定所述第二报文流是恶意报文流，所述第一时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述DGA事件中包括的事件源为第一主机，所述第一主机为所述第二报文流的源主机，所述DGA 事件指示发生了所述第一主机访问DGA域名的行为。
  24. 根据权利要求21或22所述的网关设备，其特征在于，所述获取模块，用于若存在第二时间段内生成的内网暴力破解事件，确定所述第二报文流是恶意报文流，所述第二时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述内网暴力破解事件指示发生了以第一主机所在的内网为目标的暴力破解攻击，所述第一主机为所述第二报文流的源主机；或者，若存在第二时间段内生成的敏感信息外泄事件，确定所述第二报文流是恶意报文流，所述敏感信息外泄事件指示发生了所述第一主机上的敏感信息被发送至外网的行为；或者，若存在第二时间段内生成的外网分布式拒绝服务DDoS事件，确定所述第二报文流是恶意报文流，所述外网DDoS事件指示发生了所述第一主机所在的内网对外网发起的DDoS攻击。
  25. 根据权利要求21或22所述的网关设备，其特征在于，所述获取模块，用于若第三时间段内所述模型训练之前的检测模型针对目标报文流的元数据的输出结果呈现周期性，确定所述第二报文流是恶意报文流，所述第三时间段为以所述第一网关设备获取到所述第二报文流的时刻为结束点的历史时间段，所述目标报文流包括以第一主机为源主机的至少一个报文流，所述第一主机为所述第二报文流的源主机。
  26. 根据权利要求19所述的网关设备，其特征在于，所述至少一条报文流包括第三报文流，所述获取模块，用于若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，将所述第三报文流的上下文信息发送至第二服务器，所述阻断规则用于阻断恶意报文流，所述上下文信息包括所述第三报文流的元数据或者所述第三报文流的数据包捕获PCAP报文中的至少一项；接收来自于所述第二服务器的根据所述上下文信息得到的分析结果；若所述分析结果指示所述第三报文流是恶意报文流，将所述第三报文流的元数据确定为所述恶意样本。
  27. 根据权利要求19所述的网关设备，其特征在于，所述至少一条报文流包括第三报文流，所述获取模块，用于若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，根据所述第三报文流包括的目的互联网协议IP地址或所述第三报文流包括的源IP地址，查询第一威胁情报，所述第一威胁情报包括至少一个恶意IP地址；若所述目的IP地址或所述源IP地址命中所述第一威胁情报中的恶意IP地址，将所述第三报文流的元数据确定为所述恶意样本；或者，若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，根据所述第三报文流对应的目标域名，查询第二威胁情报，所述目标域名为所述第三报文流请求访问的域名，所述第二威胁情报包括至少一个恶意域名；若所述目标域名命中所述第二威胁情报中的恶意域名，将所述第三报文流的元数据确定为所述恶意样本；或者，若所述第三报文流未命中阻断规则且通过分析确定所述第三报文流不是恶意报文流，根据所述第三报文流对应的文件标识，查询第三威胁情报，所述文件标识用于标识所述第三报文流包括的文件，所述第三威胁情报包括至少一个恶意文件标识；若所述文件标识命中所述第三威胁情报中的恶意文件标识，将所述第三报文流的元数据确定为所述恶意 样本。
  28. 根据权利要求21至26中任一项所述的网关设备，其特征在于，所述获取模块，用于接收来自于所述第一服务器的所述共享样本和所述检测模型的超参数，所述超参数包括所述检测模型的学习率以及所述检测模型的初始参数，所述学习率用于控制所述第二模型参数与所述模型训练之前的检测模型的模型参数之间的差值，所述初始参数用于生成所述初始检测模型。
  29. 根据权利要求19至28中任一项所述的网关设备，其特征在于，所述获取模块，还用于根据所述至少一条报文流获取正常样本集合，所述正常样本集合中包括的正常样本为所述至少一条报文流中正常报文流的元数据；
    所述训练模块，用于根据所述恶意样本集合、所述共享样本、所述第一模型参数和所述正常样本集合进行模型训练。
  30. 根据权利要求29所述的网关设备，其特征在于，所述网关设备还包括：
    处理模块，用于如果第一正常样本在第四时间段的出现次数超过第一阈值，从所述正常样本集合中去除所述第一正常样本，所述第四时间段为所述第一网关设备获取到所述第一正常样本的时刻所属的历史时间周期；如果第一恶意样本在所述第五时间段的出现次数超过第二阈值，从所述恶意样本集合中去除所述第一恶意样本，所述第二阈值小于所述第一阈值，所述第五时间段为所述第一网关设备获取到所述第一恶意样本的时刻所属的历史时间周期。
  31. 一种第一服务器，其特征在于，所述服务器包括：
    接收模块，用于接收来自于网关设备集合中的第一网关设备的第一模型参数，以及来自于所述网关设备集合中的第二网关设备的第二模型参数，所述第一模型参数是第一检测模型的参数，所述第一检测模型用于对通过所述第一网关设备传输的报文流是否具有恶意性进行检测，所述第二模型参数是第二检测模型的参数，所述第二检测模型用于对通过所述第二网关设备传输的报文流是否具有恶意性进行检测；
    处理模块，用于根据所述第一模型参数和所述第二模型参数进行汇聚处理，得到第三模型参数；
    发送模块，用于向所述网关设备集合中的至少一个网关设备发送所述第三模型参数。
  32. 根据权利要求31所述的服务器，其特征在于，所述处理模块，用于获取所述第一模型参数、所述第二模型参数的平均值；根据所述平均值以及学习率，获取模型参数的变化量，所述变化量为所述平均值与所述学习率的乘积，所述学习率用于控制模型训练之后的检测模型的模型参数与模型训练之前的检测模型的模型参数之间的差值；根据所述变化量对历史模型参数进行更新，得到所述第三模型参数，所述第三模型参数是所述历史模型参数与所述变化量之间的差值，所述历史模型参数是所述第一服务器在接收到所述第一模型参数和所述第二模型参数之前向所述网关设备集合中至少一个网关设备发送的模型参数。
  33. 根据权利要求31所述的服务器，其特征在于，所述处理模块，还用于确定参与联邦学习的网关设备集合；
    所述发送模块，还用于向所述网关设备集合中的至少一个网关设备发送超参数以及共享样本，所述共享样本为所述服务器提供给网关设备集合中的各个网关设备的恶意样本，所述超参数包括初始参数以及学习率，所述初始参数是所述第一检测模型以及所述第二检测模型的初始参数，所述学习率是所述第一检测模型以及所述第二检测模型的学习率。
  34. 根据权利要求33所述的服务器，其特征在于，所述处理模块，用于在沙箱中运行恶意文件，得到至少一个数据包捕获PCAP报文；根据所述至少一个PCAP报文，生成所述共享样本。
  35. 一种网关设备，其特征在于，所述网关设备包括处理器和网络接口，所述处理器用于执行指令，使得所述网关设备执行如权利要求1至权利要求12中任一项所述的方法，所述网络接口用于传输报文流以及模型参数。
  36. 一种服务器，其特征在于，所述服务器包括处理器和网络接口，所述处理器用于执行指令，使得所述服务器执行如权利要求13至权利要求16中任一项所述的方法，所述网络接口用于传输模型参数。
  37. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器读取以使网关设备执行如权利要求1至权利要求12中任一项所述的方法。
  38. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器读取以使服务器执行如权利要求13至权利要求16中任一项所述的方法。
PCT/CN2021/089390 2020-09-10 2021-04-23 检测模型的训练方法、系统、设备及存储介质 WO2022052476A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21865537.1A EP4203349A4 (en) 2020-09-10 2021-04-23 TRAINING METHOD FOR A DETECTION MODEL, SYSTEM, DEVICE AND STORAGE MEDIUM
US18/180,960 US20230231871A1 (en) 2020-09-10 2023-03-09 Training Method for Detection Model, System, Device, and Storage Medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010948783.1A CN114257386B (zh) 2020-09-10 2020-09-10 检测模型的训练方法、系统、设备及存储介质
CN202010948783.1 2020-09-10

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/180,960 Continuation US20230231871A1 (en) 2020-09-10 2023-03-09 Training Method for Detection Model, System, Device, and Storage Medium

Publications (1)

Publication Number Publication Date
WO2022052476A1 true WO2022052476A1 (zh) 2022-03-17

Family

ID=80630147

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/089390 WO2022052476A1 (zh) 2020-09-10 2021-04-23 检测模型的训练方法、系统、设备及存储介质

Country Status (4)

Country Link
US (1) US20230231871A1 (zh)
EP (1) EP4203349A4 (zh)
CN (1) CN114257386B (zh)
WO (1) WO2022052476A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115225575A (zh) * 2022-06-08 2022-10-21 香港理工大学深圳研究院 一种基于元数据辅助和联邦学习的未知网络流量分类方法
CN115567289A (zh) * 2022-09-23 2023-01-03 清华大学 加密dns协议下基于联邦图模型的恶意域名检测方法及系统
US11593485B1 (en) * 2022-06-17 2023-02-28 Uab 360 It Malware detection using federated learning
US11973785B1 (en) 2023-06-19 2024-04-30 King Faisal University Two-tier cybersecurity method

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114461568B (zh) * 2022-04-14 2022-07-08 苏州浪潮智能科技有限公司 一种数据处理方法、系统、设备及可读存储介质
WO2023238246A1 (ja) * 2022-06-07 2023-12-14 日本電信電話株式会社 統合モデル生成方法、統合モデル生成装置および統合モデル生成プログラム
CN115865487A (zh) * 2022-11-30 2023-03-28 四川启睿克科技有限公司 一种具有隐私保护功能的异常行为分析方法和装置
CN116150753A (zh) * 2022-12-21 2023-05-23 上海交通大学 一种基于联邦学习的移动端恶意软件检测系统
CN115840965B (zh) * 2022-12-27 2023-08-08 光谷技术有限公司 一种信息安全保障模型训练方法和系统
CN116527411B (zh) * 2023-07-05 2023-09-22 安羚科技(杭州)有限公司 数据安全智能防护模型构建方法、装置及协作平台
CN116599767B (zh) * 2023-07-12 2023-11-03 深圳市光网世纪科技有限公司 基于机器学习的网络威胁监测系统
CN116992450B (zh) * 2023-09-27 2024-01-23 北京安天网络安全技术有限公司 一种文件检测规则确定方法及装置、电子设备及存储介质
CN117118761B (zh) * 2023-10-25 2024-04-09 中汽智联技术有限公司 一种贯穿智能汽车信息安全的纵深防御系统和方法
CN117499129B (zh) * 2023-11-15 2024-05-03 南方电网数字电网集团信息通信科技有限公司 应用于入侵检测系统的规则同步方法、装置和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190068620A1 (en) * 2017-08-30 2019-02-28 International Business Machines Corporation Detecting malware attacks using extracted behavioral features
CN110572382A (zh) * 2019-09-02 2019-12-13 西安电子科技大学 基于smote算法和集成学习的恶意流量检测方法
CN111356998A (zh) * 2017-09-28 2020-06-30 国际联合航空集团股份有限公司 机器学习查询处理系统
CN111444848A (zh) * 2020-03-27 2020-07-24 广州英码信息科技有限公司 一种基于联邦学习的特定场景模型升级方法和系统

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109189825B (zh) * 2018-08-10 2022-03-15 深圳前海微众银行股份有限公司 横向数据切分联邦学习建模方法、服务器及介质
CN109165725B (zh) * 2018-08-10 2022-03-29 深圳前海微众银行股份有限公司 基于迁移学习的神经网络联邦建模方法、设备及存储介质
CN110288094B (zh) * 2019-06-10 2020-12-18 深圳前海微众银行股份有限公司 基于联邦学习的模型参数训练方法及装置
CN110443063B (zh) * 2019-06-26 2023-03-28 电子科技大学 自适性保护隐私的联邦深度学习的方法
CN110620760A (zh) * 2019-07-30 2019-12-27 东南大学 一种SVM和贝叶斯网络的FlexRay总线融合入侵检测方法和检测装置
CN110572253B (zh) * 2019-09-16 2023-03-24 济南大学 一种联邦学习训练数据隐私性增强方法及系统
CN111176929B (zh) * 2019-11-29 2023-04-18 广东工业大学 一种面向边缘联邦学习的高能效计算通信联合优化方法
CN111275207B (zh) * 2020-02-10 2024-04-30 深圳前海微众银行股份有限公司 基于半监督的横向联邦学习优化方法、设备及存储介质
CN111477290B (zh) * 2020-03-05 2023-10-31 上海交通大学 保护用户隐私的联邦学习和图像分类方法、系统及终端
CN111428881B (zh) * 2020-03-20 2021-12-07 深圳前海微众银行股份有限公司 识别模型的训练方法、装置、设备及可读存储介质
CN111476376B (zh) * 2020-06-24 2020-10-16 支付宝(杭州)信息技术有限公司 联盟学习方法、联盟学习装置及联盟学习系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190068620A1 (en) * 2017-08-30 2019-02-28 International Business Machines Corporation Detecting malware attacks using extracted behavioral features
CN111356998A (zh) * 2017-09-28 2020-06-30 国际联合航空集团股份有限公司 机器学习查询处理系统
CN110572382A (zh) * 2019-09-02 2019-12-13 西安电子科技大学 基于smote算法和集成学习的恶意流量检测方法
CN111444848A (zh) * 2020-03-27 2020-07-24 广州英码信息科技有限公司 一种基于联邦学习的特定场景模型升级方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4203349A4

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115225575A (zh) * 2022-06-08 2022-10-21 香港理工大学深圳研究院 一种基于元数据辅助和联邦学习的未知网络流量分类方法
CN115225575B (zh) * 2022-06-08 2023-11-24 香港理工大学深圳研究院 一种基于元数据辅助和联邦学习的未知网络流量分类方法
US11593485B1 (en) * 2022-06-17 2023-02-28 Uab 360 It Malware detection using federated learning
US11693965B1 (en) 2022-06-17 2023-07-04 Uab 360 It Malware detection using federated learning
US11763000B1 (en) 2022-06-17 2023-09-19 Uab 360 It Malware detection using federated learning
US11775642B1 (en) 2022-06-17 2023-10-03 Uab 360 It Malware detection using federated learning
CN115567289A (zh) * 2022-09-23 2023-01-03 清华大学 加密dns协议下基于联邦图模型的恶意域名检测方法及系统
US11973785B1 (en) 2023-06-19 2024-04-30 King Faisal University Two-tier cybersecurity method

Also Published As

Publication number Publication date
CN114257386B (zh) 2023-03-21
EP4203349A4 (en) 2024-02-21
CN114257386A (zh) 2022-03-29
EP4203349A1 (en) 2023-06-28
US20230231871A1 (en) 2023-07-20

Similar Documents

Publication Publication Date Title
WO2022052476A1 (zh) 检测模型的训练方法、系统、设备及存储介质
US11750653B2 (en) Network intrusion counter-intelligence
Koroniotis et al. Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset
AlEroud et al. Identifying cyber-attacks on software defined networks: An inference-based intrusion detection approach
Xing et al. Survey on botnet detection techniques: Classification, methods, and evaluation
WO2021088372A1 (zh) SDN网络中基于神经网络的DDoS检测方法及系统
EP3855692A1 (en) Network security monitoring method, network security monitoring device, and system
US10375143B2 (en) Learning indicators of compromise with hierarchical models
CN110521171A (zh) 用于应用性能监视和管理的流簇解析
Bhuyan et al. Survey on incremental approaches for network anomaly detection
Catak et al. Distributed denial of service attack detection using autoencoder and deep neural networks
Choobdar et al. Detection and multi-class classification of intrusion in software defined networks using stacked auto-encoders and CICIDS2017 dataset
Doriguzzi-Corin et al. FLAD: adaptive federated learning for DDoS attack detection
Bhor et al. TRUST‐based features for detecting the intruders in the Internet of Things network using deep learning
Bhardwaj et al. Network intrusion detection in software defined networking with self-organized constraint-based intelligent learning framework
Fan et al. Autoiot: Automatically updated iot device identification with semi-supervised learning
Fenil et al. Towards a secure software defined network with adaptive mitigation of dDoS attacks by machine learning approaches
Wang et al. Abnormal traffic detection system in SDN based on deep learning hybrid models
Jamshidi The Applications of Machine Learning Techniques in Networking
Zhao et al. DDoS family: A novel perspective for massive types of DDoS attacks
Sivalingam Applications of artificial intelligence, machine learning and related techniques for computer networking systems
Cui et al. Only Header: A reliable encrypted traffic classification framework without privacy risk
Chen et al. Dynamic threshold strategy optimization for security protection in Internet of Things: An adversarial deep learning‐based game‐theoretical approach
Sivanesan et al. Detecting distributed denial of service (DDoS) in SD-IoT environment with enhanced firefly algorithm and convolution neural network
Prasad et al. DEFAD: ensemble classifier for DDOS enabled flood attack defense in distributed network environment

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021865537

Country of ref document: EP

Effective date: 20230322

NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21865537

Country of ref document: EP

Kind code of ref document: A1