CN114244588B - Big data analysis interception method and information interception system applying artificial intelligence analysis - Google Patents

Abstract

The embodiment of the application discloses a big data analysis interception method and an information interception system applying artificial intelligence analysis. Therefore, the interception decision accuracy of the access activity can be improved, and the network convergence optimization performance is improved.

Description

Big data analysis interception method and information interception system applying artificial intelligence analysis

technical field

The present application relates to the technical field of artificial intelligence, in particular, to a big data analysis interception method and an information interception system applying artificial intelligence analysis.

Background technique

With the advent of the era of big data, information security issues have always been the top priority in the development of cloud computing. Traditional security thinking is difficult to solve problems such as cloud boundary breaking, and cloud computing lacks deep accumulation of security in the development process. Based on this, for access activities that need to be intercepted, such as attack access activities, privacy access activities, etc., the accuracy of interception decision-making is related to information security performance. However, the accuracy of interception decision-making for access activities in related technologies needs to be improved.

Contents of the invention

The present application provides a big data analysis interception method and an information interception system applying artificial intelligence analysis.

In the first aspect, the embodiment of the present application provides a big data analysis and interception method using artificial intelligence analysis, which is applied to an information interception system, including:

When receiving the access trigger event of the target access activity for real-time status transmission by the business service system, generate the corresponding target access trigger event;

According to the first access activity interception decision-making network, based on the target access trigger event, decision-making and generation of the basic interception decision-making basis associated with the target access activity; the first access activity interception decision-making network is based on the basic reference data set for network convergence optimization Obtained, the basic reference data set includes the first reference access trigger event and the carried basic reference intercept basis, the basic reference intercept basis is based on the release of the access activity corresponding to the first reference access trigger event. Whether the state is configured to be obtained from the destroyed state;

According to the second access activity interception decision-making network, based on the target access trigger event, decision-making generates the advanced interception decision-making basis associated with the target access activity; the second access activity interception decision-making network is based on the advanced reference data set. Obtained by convergence optimization, the advanced reference data set includes the second reference access trigger event and the carried advanced reference intercept basis, the advanced reference intercept basis represents the access activity corresponding to the second reference access trigger event tag attribute;

Based on the basic interception decision basis and the advanced interception decision basis, a target interception decision basis associated with the target access activity is determined; the target interception decision basis represents a threat output view of the target access activity.

Compared with the existing technology, the first access activity interception decision network obtained by network convergence optimization based on benchmark supervised training and learning and the second access activity interception decision network obtained by network convergence optimization based on advanced supervised training and learning are respectively used to target access The interception decision is made according to the activity, so as to combine the interception decision-making basis obtained by two interception decision-making networks with different training methods to determine whether the target access activity can be classified as an interception access activity. Among them, the first access activity interception decision network is obtained by network convergence optimization based on the basic reference data set marked by the benchmark basis labeling strategy. The benchmark basis labeling strategy means that the access activities corresponding to the reference access trigger events in the reference data set are released After searching for relevant processes, destroy the access activity maintenance status, to mark whether the access activity corresponding to the reference access trigger event can be classified as intercepted access activity, compared with only adopting the advanced basis labeling strategy, according to the benchmark basis labeling strategy Annotating reference datasets requires less labeling workload, and more reference datasets can be obtained, so the first access activity interception decision network with preliminary interception decision performance can be generated under the premise of reducing the labeling workload. Based on the first access activity interception decision-making network-assisted decision whether the access activity can be classified as interception access activity, the requirement for the training data set of the second access activity interception decision network can be reduced, for example, it can be reduced in the second access activity interception decision network. The number of reference data sets called by the second access activity interception decision-making network during the network convergence optimization process, thereby reducing the training workload of the second access activity interception decision-making network. In this way, combining the first access activity interception decision network and the second access activity interception decision network to decide to intercept access activities can improve the accuracy of access activity interception decisions and improve network convergence optimization performance.

Description of drawings

FIG. 1 is a schematic flow chart of the steps of a method for analyzing and intercepting big data using artificial intelligence analysis provided by an embodiment of the present application.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

Step S101: After receiving the access trigger event of the target access activity for real-time status transmission by the business service system, determine it as the target access trigger event.

Step S102: According to the first access activity interception decision network, based on the target access trigger event, decide to generate the basic interception decision basis associated with the target access activity; the first access activity interception decision network is based on the basic reference data set Obtained by network convergence optimization, the basic reference data set includes the first reference access trigger event and the carried basic reference intercept basis, and the basic reference intercept basis is based on releasing the access activity corresponding to the first reference access trigger event Whether the access activity maintenance state is configured in the destroyed state obtained.

After the information interception system obtains the target access trigger event, it can input the target access trigger event into the first access activity interception decision network that meets the network deployment requirements, and the first access activity interception decision network intercepts the target access trigger event After the prediction, the basic interception decision-making basis associated with the target access activity will be correspondingly output, and the basic interception decision-making basis can be understood as the confidence level that the target access activity is classified into the interception access activity.

For example, the aforementioned first access activity blocking decision network may be obtained by performing network convergence optimization based on a basic reference data set in a benchmark supervised training and learning manner. The benchmark supervised training learning method can be understood as the interception decision basis in the reference data set called during the network convergence optimization process may not be completely accurate; The basic reference intercept basis in the reference data set can be understood as a training reference basis with low accuracy. The aforementioned basic reference data set includes the first reference access trigger event and the basic reference interception basis carried; wherein, the first reference access trigger event may be an access trigger event in past access activities; the basic reference interception event corresponding to the first reference access trigger event The basis may be obtained based on whether a relevant process is found to destroy the access activity maintenance state after the past access activity corresponding to the first reference access trigger event is released.

For example, if it is determined that the access activity corresponding to the first reference access trigger event is released, and the relevant process is found to destroy the access activity maintenance state, then the basic reference intercept basis corresponding to the first reference access trigger event will correspond to the first reference access The access activity corresponding to the trigger event is classified as intercepting access activity (i.e. intercepting access activity), and the destruction time series data of the access state corresponding to the first reference access trigger event will correspond to represent the access activity corresponding to the first reference access trigger event The timing interval information between the comparison access activity, where the comparison access activity is the last access activity that is released before the maintenance state of the access activity is configured in the destroyed state.

For example, before the information interception system releases the access activities in the access event, it will assign the corresponding sequence position number to each access activity in the access event based on its corresponding release time sequence. The earlier the release time sequence, the corresponding sequence position number The smaller it is, the later the release sequence is, and the corresponding sequence position number is larger. After the information interception system searches for an access event that triggers the destruction of the access activity maintenance state, it can first determine the last access activity displayed in the access event before the access activity maintenance state is configured in the destroyed state (that is, the corresponding sequence position The access activity with the largest number) is used as the control access activity, and then for each access activity included in the access event before the access activity maintenance state is configured in the destroyed state, calculate the sequence position number associated with the control access activity and the sequence position number associated with the access activity The timing difference is determined as the destruction timing data of the access state associated with the access activity, that is, the destruction timing data of the access state corresponding to the access trigger event in the access activity.

If it is determined that the access activity corresponding to the first reference access trigger event is released, and no relevant process is found to destroy the access activity maintenance status, then the basic reference intercept basis corresponding to the first reference access trigger event will correspond to the first reference access trigger event. The access activity corresponding to the event is classified as a non-intercepted access activity (that is, not an intercepted access activity). In addition, since the access activity corresponding to the first reference access trigger event is released, no access activity maintenance state is found and configured in the destroyed state, it is difficult to determine the destruction sequence data of the access state corresponding to the first reference access trigger event, Thus, the timing data for destroying the access status corresponding to the first reference access trigger event can be directly configured as the timing interval value of the non-intercepting access activity; the timing interval value of the non-intercepting access activity can be the timing interval reference configured in advance by the information interception system The value can also be determined by the information interception system based on other included basic reference intercepts based on the destruction time series data of the access state belonging to the basic reference data set of the interception access activity, for example, the information interception system can obtain the included basic reference interception Based on all the basic reference data sets that belong to the intercepted access activities, the average time series value of the destruction time series data of the access status included in these basic reference data sets is calculated, and it is determined as the time series interval value of the non-intercepted access activities. The implementation manner of determining the time series interval value of the access activity is limited.

In this way, the destruction sequence data of the access state is extended in the basic reference data set used to train the first access activity interception decision network, so that the first access activity interception decision network has a destruction sequence that comprehensively considers the access activity trigger event and the access state The ability of the data to identify whether the access activity can be classified as an intercepted access activity can improve the accuracy of the first access activity interception decision network decision to intercept the access activity.

In addition, if it is determined that the basic reference data set for training the first access activity interception decision-making network call includes access state destruction time series data, then when the first access activity interception decision-making network is used to identify whether the access activity can be classified as an interception access activity, It is also possible for the first access activity interception decision network to simultaneously calibrate the destruction time-series data of the access status and the access activity trigger event to execute the access activity decision process. That is, when using the first access activity interception decision-making network to determine the basic interception decision basis associated with the target access activity, the calibrated destruction timing data of the access state should be obtained, and the calibrated destruction timing data of the access state can be based on training the first access It is determined by the destruction timing data of the access state in the basic reference data set called when the activity intercepts the decision-making network; furthermore, according to the first access activity intercepting the decision-making network, based on the target access trigger event in the target access activity and the calibrated access state Destroy the time series data to generate the basic interception decision-making basis associated with the target access activity.

In an exemplary design idea, the aforementioned first access activity interception decision-making network may include a first basic description variable mining unit and a first interception decision-making unit, and the first access activity interception decision-making network is summarized in a specific application process, and may first be based on The first basic description variable mining unit mines the basic description variables corresponding to each access unit in the target access trigger event; furthermore, according to the first interception decision-making unit, based on the basic description variables corresponding to each access unit in the target access trigger event , the basic interception decision-making basis associated with the decision-making target access activity.

For example, the first access activity interception decision network may include a first basic description variable mining unit A1 and a first interception decision-making unit A2; for example, the first basic description variable mining unit A1 may include an RNN unit and a fully connected unit, the The RNN unit may be, for example, GRU or LSTM, and the first intercept decision unit A2 may include a first fully connected unit, a CNN unit, a dimensionality reduction unit, and a second fully connected unit.

During the application process of the first access activity interception decision network, according to the RNN unit in the first basic description variable mining unit A1, the access description variable mining of each access unit included in the target access trigger event can be carried out, and each of the target access trigger events can be obtained. The basic access description variables corresponding to the access units, and then according to the full connection unit in the first basic description variable mining unit A1, process the basic access description variables corresponding to each access unit in the target access trigger event to obtain the target access trigger event The basic description variables corresponding to each access unit in . Then, according to the first fully-connected unit, CNN unit, dimensionality reduction unit, and second fully-connected unit in the first interception decision-making unit A2, the basic description variables corresponding to each access unit in the target access trigger event are sequentially processed to obtain The basic interception decision-making basis associated with the target access activity.

Step S103: According to the second access activity interception decision-making network, based on the target access trigger event, make a decision to generate an advanced interception decision basis associated with the target access activity; the second access activity interception decision-making network is based on advanced reference data The advanced reference data set includes the second reference access trigger event and the carried advanced reference intercept basis, and the advanced reference intercept basis represents the second reference access trigger event corresponding to Access the label properties of the activity.

After the information interception system obtains the target access trigger event, it can also input the target access trigger event into the second access activity interception decision network that meets the network deployment requirements, and the second access activity interception decision network intercepts the target access trigger event After the prediction, an advanced interception decision-making basis associated with the target access activity is correspondingly generated. The advanced interception decision-making basis may be, for example, the confidence level that the target access activity is classified into the intercepted access activity.

Wherein, the aforementioned second access activity interception decision-making network is obtained based on advanced supervised training and learning and network convergence optimization based on advanced reference data sets. The difference between advanced supervised training and learning and the aforementioned benchmark supervised training and learning is that the interception decision basis in the called reference data set is comprehensive and accurate; The advanced reference intercept basis in the advanced reference data set is a comprehensive and accurate training reference basis. The aforementioned advanced reference data set includes the second reference access trigger event and the carried advanced reference intercept basis. The advanced reference intercept basis corresponding to the second reference access trigger event may be marked for the access activity corresponding to the second reference access trigger event, which may represent the label attribute of the access activity corresponding to the second reference access trigger event, That is, it fully and accurately characterizes whether the access activity corresponding to the second reference access trigger event can be classified as an intercepting access activity.

In an exemplary design idea, the aforementioned second access activity interception decision-making network may include a second basic description variable mining unit and a second interception decision-making unit, and the second access activity interception decision-making network may first be based on the first The second basic description variable mining unit mines the basic description variables corresponding to each access unit in the target access trigger event; furthermore, according to the second interception decision-making unit, based on the basic description variables corresponding to each access unit in the target access trigger event, Decision-making basis for advanced interception decisions associated with targeted access activities.

For example, the second access activity interception decision network includes a second basic description variable mining unit B01 and a second interception decision-making unit B02; for example, the second basic description variable mining unit B01 may include an RNN unit and a fully connected unit, and the RNN Specifically, the unit may be a GRU or LSTM structure, and the second interception decision-making unit B02 may include a first fully connected unit, a CNN unit, a pooling unit, and a second fully connected unit.

During the application process of the second access activity interception decision-making network, according to the RNN unit in the second basic description variable mining unit B01, the access description variable mining of each access unit included in the input target access trigger event can be performed to obtain the target access trigger event The basic access description variables corresponding to each access unit in , and then according to the full connection unit in the second basic description variable mining unit B01, process the basic access description variables corresponding to each access unit in the target access trigger event to obtain the target Basic description variables corresponding to each access unit in the access trigger event. Then, according to the first fully-connected unit, CNN layer, pooling layer and second fully-connected unit in the second interception decision-making unit B02, the basic description variables corresponding to each access unit in the target access trigger event are sequentially processed to obtain Advanced interception decision basis associated with targeted access activities.

Wherein, on the basis that the first access activity interception decision-making network includes the first basic description variable mining unit and the first interception decision-making unit, and the second access activity interception decision-making network includes the second basic description variable mining unit and the second interception decision-making unit , in order to improve the network convergence speed of the first access activity interception decision network and the second access activity interception decision network, the network parameter layer can be set in both the first basic variable mining unit and the second basic variable mining unit, and train the first access activity When intercepting the decision-making network and the second access activity intercepting the decision-making network, the network weight information of the network parameter layer included in the two interception decision-making networks can be made to be the same, that is, the network weight information of the network parameter layer in the first access activity intercepting decision-making network is configured synchronously at the network parameter layer in the second access activity interception decision-making network, or synchronously configure the network weight information of the network parameter layer in the second access activity interception decision-making network at the network parameter layer in the first access activity interception decision-making network, so that this The network convergence process of the two interception decision networks can learn from each other, thereby improving the network convergence speed and accuracy.

The aforementioned network parameter layer may include at least one of the following: the RNN unit in the first basic description variable mining unit and the second basic description variable mining unit, the first basic description variable mining unit and the full connection in the second basic description variable mining unit unit. That is, in the model training phase, the information interception system can make the RNN unit in the first basic descriptive variable mining unit and the RNN unit in the second basic descriptive variable mining unit carry out the same network weight information, and can also make the first basic descriptive variable mining unit The fully connected unit in the first basic description variable mining unit and the fully connected unit in the second basic description variable mining unit carry out the same network weight information, and the RNN unit and the fully connected unit in the first basic description variable mining unit can also be connected with the second basic description variable mining unit The RNN unit and the fully connected unit in the network carry out the same network weight information respectively.

Step S104: Based on the basic interception decision basis and the advanced interception decision basis, determine the target interception decision basis associated with the target access activity; the target interception decision basis represents the threat output point of view of the target access activity.

The information interception system obtains the basic interception decision-making basis related to the target access activity according to step S102, and after obtaining the advanced interception decision-making basis related to the target access activity according to step S103, it can comprehensively consider the basic interception decision-making basis and the advanced interception decision-making basis to determine the target The target interception decision basis associated with the access activity, where the target interception decision basis represents whether the target access activity can be classified as an interception access activity.

For example, on the basis that both the basic interception decision-making basis and the advanced interception decision-making basis are based on the confidence level that the target access activity is classified as the interception access activity, the information interception system can base on the set importance parameters, and the basic interception decision-making basis and the advanced interception decision-making basis The interception decision is based on weight fusion, and the obtained confidence level is the target interception decision basis associated with the target access activity. If it is determined that the confidence level is greater than the target confidence level, it can be determined that the target access activity is classified as an interception access activity. If the target access activity is determined to be If the confidence degree is not greater than the target confidence degree, it can be determined that the target access activity does not belong to the blocking access activity.

Based on the above steps, use the first access activity interception decision network obtained by network convergence optimization based on benchmark supervised training and learning and the second access activity interception decision network obtained by network convergence optimization based on advanced supervised training and learning to conduct target access activities An interception decision is made, so as to determine whether the target access activity can be classified as an interception access activity by combining the interception decision-making basis obtained by two interception decision-making networks with different training methods. Among them, the first access activity interception decision network is obtained by network convergence optimization based on the basic reference data set marked by the benchmark basis labeling strategy. The benchmark basis labeling strategy means that the access activities corresponding to the reference access trigger events in the reference data set are released After searching for relevant processes, destroy the access activity maintenance status, to mark whether the access activity corresponding to the reference access trigger event can be classified as intercepted access activity, compared with only adopting the advanced basis labeling strategy, according to the benchmark basis labeling strategy Annotating reference datasets requires less labeling workload, and more reference datasets can be obtained, so the first access activity interception decision network with preliminary interception decision performance can be generated under the premise of reducing the labeling workload. Based on the first access activity interception decision-making network-assisted decision whether the access activity can be classified as interception access activity, the requirement for the training data set of the second access activity interception decision network can be reduced, for example, it can be reduced in the second access activity interception decision network. The number of reference data sets called by the second access activity interception decision-making network during the network convergence optimization process, thereby reducing the training workload of the second access activity interception decision-making network. In this way, combining the first access activity interception decision network and the second access activity interception decision network to decide to intercept access activities can improve the accuracy of access activity interception decisions and improve network convergence optimization performance.

In an exemplary design idea, the aforementioned basic reference data set is further added with destruction timing data of the access state corresponding to the first reference access trigger event.

On this basis, if it is determined that the access activity corresponding to the first reference access trigger event is released and the access activity maintenance state is configured in the destroyed state, then the basic reference interception basis represents the first reference The access activity corresponding to the access trigger event is classified as an interception access activity, and the destruction time series data of the access state represents the time series interval information between the access activity corresponding to the first reference access trigger event and the comparison access activity, the The control access activity is the last access activity released before the maintenance state of the access activity is configured in the destroyed state;

In addition, if it is determined that the access activity corresponding to the first reference access trigger event is released and the access activity maintenance state is configured in the destroyed state, the basic reference interception basis represents the first reference access trigger event The corresponding access activities are classified as non-intercepted access activities, and the destruction time series data of the access state is the time series interval value of the non-intercepted access activities.

In an exemplary design idea, on the basis of adding the destruction timing data of the access state corresponding to the first reference access trigger event, for step S120, the calibrated destruction timing data of the access state can be obtained, for example, The marked destruction timing data of the access state is obtained based on the destruction timing data of the access state in the basic reference data set invoked when performing network convergence optimization on the first access activity interception decision network. Then, the basic interception decision basis may be generated according to the first access activity interception decision network based on the target access trigger event and the marked destruction sequence data of the access state.

In another exemplary design idea, the first access activity interception decision-making network includes a first basic description variable mining unit and a first interception decision-making unit, and the second access activity interception decision-making network includes a second The base describes the variable mining unit and the second interception decision unit.

On this basis, for step S120, for example, according to the first basic description variable mining unit, the basic description variables corresponding to each access unit in the target access trigger event may be mined. Then, according to the first interception decision-making unit, based on the basic description variables corresponding to each access unit in the target access trigger event, decide to generate the basic interception decision-making basis;

On this basis, for step S130, for example, according to the second basic description variable mining unit, the basic description variables corresponding to each access unit in the target access trigger event may be mined. Then, according to the second interception decision-making unit, based on the basic description variables corresponding to each access unit in the target access trigger event, decision-making to generate the advanced interception decision-making basis is made.

Wherein, in an exemplary design idea, the first basic descriptive variable mining unit and the second basic descriptive variable mining unit may be configured with the same network parameter layer of network weight information. Wherein, the network parameter layer includes at least one of the following: the cyclic neural network layer in the first basic description variable mining unit and the second basic description variable mining unit, the first basic description variable mining unit and the The second basis describes fully connected units in variable mining units.

In an exemplary design idea, the first access activity interception decision network and the second access activity interception decision network include network parameter layers with the same network weight information. The first access activity interception decision network and the second access activity interception decision network may be trained in the following manner:

Step S101, according to the first basic access activity interception decision network, based on the first reference access trigger event in the basic reference data set, decide to generate a first access activity interception decision basis;

Step S102, based on the first access activity interception decision basis and the basic reference interception basis in the basic reference data set, determine a first interception prediction cost;

Step S103, performing network convergence optimization on the first basic access activity interception decision network according to the first interception prediction cost;

Step S104, synchronously configuring the network weight information of the network parameter layer in the first basic access activity interception decision network to the network parameter layer in the second basic access activity interception decision network;

Step S105, according to the second basic access activity interception decision network, based on the second reference access trigger event in the advanced reference data set, decide to generate a second access activity interception decision basis;

Step S106, based on the second access activity interception decision basis and the advanced reference interception basis in the advanced reference data set, determine a second interception prediction cost;

Step S107, performing network convergence optimization on the second basic access activity interception decision network according to the second interception prediction cost;

Step S108, synchronously configuring the network weight information of the network parameter layer in the second basic access activity interception decision network to the network parameter layer in the first basic access activity interception decision network;

Step S109, determining a target interception prediction cost based on the first interception prediction cost and the second interception prediction cost;

Step S1010, according to the target interception prediction cost, combine and optimize the network convergence of the first basic access activity interception decision network and the second basic access activity interception decision network.

In an exemplary design idea, the embodiment of the present application also provides an artificial intelligence-based interception decision-making network training method, which may include the following steps:

Step Q110, obtaining a weight-initialized access trigger event decision network and a third reference data set; the access trigger event decision network is configured to execute a basic access trigger event decision process, and the access trigger event decision network includes the network parameters Layer; the third reference data set includes a third reference access trigger event and a carried training reference basis, where the training reference basis represents the label attribute of the third reference access trigger event in the access trigger event decision process;

Step Q120, according to the access trigger event decision network, based on the third reference access trigger event in the third reference data set, decide to generate a third access activity interception decision basis; based on the third access activity interception decision basis and the training reference basis in the third reference data set to determine a third intercept prediction cost;

Step Q130, performing network convergence optimization on the access trigger event decision network according to the third interception prediction cost;

Step Q140, synchronously configure the network weight information of the network parameter layer in the access trigger event decision network in the first basic access activity interception decision network or the second basic access activity interception decision network Network parameter layer;

Wherein, on this basis, for the aforementioned step S109 and step S1010, the target interception prediction cost may be determined based on the first interception prediction cost, the second interception prediction cost and the third interception prediction cost, According to the target interception prediction cost, network convergence optimization is performed on the first basic access activity interception decision network, the second basic access activity interception decision network and the access trigger event decision network.

In an exemplary design idea, the embodiment of the present application also provides an artificial intelligence-based interception decision-making network training method, which may include the following steps:

Step W110, obtaining a weight-initialized descriptive variable mining network and a fourth reference data set; the descriptive variable mining network is configured to mine access descriptive variables corresponding to each access unit in an access trigger event, and the descriptive variable mining network includes The network parameter layer; the fourth reference data set includes a fourth reference access trigger event;

Step W120, mining the network according to the descriptive variables, mining the decision-making visit descriptive variables corresponding to each visit unit in the fourth reference visit trigger event;

Step W130, for each reference access unit in the fourth reference access trigger event, determine the associated forward extension access unit and backward extension access unit, based on each of the reference access units in the fourth reference access trigger event Corresponding decision access description variables, decision access description variables of forward extension access units associated with each reference access unit, and decision access description variables of backward extension access units associated with each reference access unit , determining a fourth interception prediction cost; and performing network convergence optimization on the description variable mining network according to the fourth interception prediction cost;

Step W140, synchronously configuring the network weight information of the network parameter layer in the descriptive variable mining network in the first basic access activity interception decision network or the network in the second basic access activity interception decision network parameter layer.

In an exemplary design idea, on this basis, for the aforementioned step S109 and step S1010, based on the first interception prediction cost, the second interception prediction cost and the fourth interception prediction cost, determine The target interception prediction cost is combined to perform network convergence optimization on the first basic access activity interception decision network, the second basic access activity interception decision network and the descriptive variable mining network according to the target interception prediction cost.

In an exemplary design idea, in step W130, for each reference access unit in the fourth reference access trigger event, determine the The remaining reference access units are determined as the forward extension access units associated with the reference access unit, and for each reference access unit in the fourth reference access trigger event, other reference access units other than the fourth reference access trigger event are determined. The reference access unit in the access trigger event is determined as the backward extension access unit associated with the reference access unit.

In an exemplary design concept, step W130 may be implemented through the following exemplary steps.

Step W131, for each reference access unit in the fourth reference access trigger event, based on the reference access unit and the carried forward extension access unit, form a forward extension cluster associated with the reference access unit, and determine The matching value between the decision access description variable of the forward extension access unit and the decision access description variable of the reference access unit in the forward extension cluster is determined as the matching value associated with the forward extension cluster.

Step W132, based on the reference access unit and the carried backward extension access unit, construct a backward extension cluster associated with the reference access unit, and determine the decision access of the backward extension access unit in the backward extension cluster The matching value between the description variable and the decision access description variable of the reference access unit is determined as the matching value associated with the backward expansion cluster.

Step W133, for each reference access unit in the fourth reference access trigger event, based on the matching value associated with each forward extension cluster associated with the reference access unit and each subsequent extension cluster associated with the reference access unit The matching values associated with the extension clusters are used to determine the extension cost associated with the reference access unit.

Step W134: Determine the fourth interception prediction cost based on the extended cost associated with each reference access unit in the fourth reference access trigger event.

In an exemplary design idea, in step W133, the association of the reference access unit may be determined according to each forward extension cluster associated with the reference access unit and each backward extension cluster associated with the reference access unit. A plurality of positive and backward expansion clusters; each of the forward and backward expansion clusters includes one forward expansion cluster and one backward expansion cluster.

On this basis, for each of the forward and backward extension clusters associated with the reference access unit, the matching value associated with the forward extension cluster and the matching value associated with the backward extension cluster in the forward and backward extension clusters may be calculated The difference is determined as the extension cost associated with the forward and backward extension cluster, and the extension cost associated with the reference access unit is determined based on the extension costs associated with each forward and backward extension cluster associated with the reference access unit.

In an exemplary design idea, the embodiment of the present application also provides an artificial intelligence-based interception decision-making network training method, which may include the following steps:

Step R110, obtaining weight-initialized access trigger event decision network and descriptive variable mining network, as well as the third reference data set and the fourth reference data set; the access trigger event decision network is configured to execute the basic access trigger event decision process, The description variable mining network is configured to mine access description variables corresponding to each access unit in the access trigger event, and the access trigger event decision network and the description variable mining network both include the network parameter layer; the second The three reference data sets include the third reference access trigger event and the carried training reference basis, the training reference basis represents the label attribute of the third reference access trigger event in the access trigger event decision process; the fourth reference the data set includes a fourth reference access trigger event;

Step R120, according to the access trigger event decision network, based on the third reference access trigger event in the third reference data set, decide to generate a third access activity interception decision basis; based on the third access activity interception decision basis and the training reference basis in the third reference data set to determine a third intercept prediction cost;

Step R130, performing network convergence optimization on the access trigger event decision network according to the third interception prediction cost;

Step R140, synchronously configuring the network weight information of the network parameter layer in the access trigger event decision network to the network parameter layer in the descriptive variable mining network;

Step R150: Mining the network according to the description variable, mining the decision access description variable corresponding to each access unit in the fourth reference access trigger event; The forward extension access unit and the backward extension access unit are based on the decision access description variable corresponding to each reference access unit in the fourth reference access trigger event, and the forward direction associated with each reference access unit. The decision-making access description variable of the extended access unit and the decision-making access description variable of the backward extended access unit associated with each of the reference access units determine the fourth interception prediction cost;

Step R160, performing network convergence optimization on the descriptive variable mining network according to the fourth interception prediction cost;

Step R170: Mining the network weight information of the network parameter layer in the descriptive variable mining network, and synchronously configuring the network in the first basic access activity interception decision network or the second basic access activity interception decision network parameter layer;

In an exemplary design idea, on this basis, for the aforementioned step S109 and step S1010, based on the first interception prediction cost, the second interception prediction cost, the third interception prediction cost and the The fourth interception prediction cost is to determine the target interception prediction cost, and according to the target interception prediction cost, combine the first basic access activity interception decision network, the second basic access activity interception decision network, the access The trigger event decision network and the description variable mining network are optimized for network convergence.

For example, in an exemplary design idea, on the basis of the above description and on the basis of determining the target interception decision basis associated with the target access activity, the method provided by the embodiment of the present application may further include the following steps.

Based on the target interception decision basis associated with the target access activity of the target access activity carried out by the business service system for real-time state transmission, the target access activity is intercepted and the decision is made, and the interception feedback process of the target access activity after the interception is determined is obtained. Intercept feedback data;

Adding multiple forward feedback knowledge points in the intercepted feedback data to the forward feedback knowledge graph, and adding multiple backward feedback knowledge points in the intercepted feedback data to the backward feedback knowledge graph;

Searching for key knowledge entities on the forward feedback knowledge map and the backward feedback knowledge map respectively, and obtaining the forward key knowledge entities and backward key knowledge entities associated with each feedback process of concern in the interception feedback process;

Based on the historical frequent item entities of the forward feedback knowledge map and the backward feedback knowledge map, combine the forward key knowledge entities and backward key knowledge entities associated with each of the attention feedback processes to obtain the each a combined key knowledge entity focusing on the feedback process;

Based on the combined key knowledge entities of each focused feedback process, corresponding intercepted feedback reference data is generated.

Among them, the forward feedback knowledge point can refer to the feedback knowledge point after the interception decision and before the interception execution, and the backward feedback knowledge point can refer to the feedback knowledge point after the interception decision and after the interception execution. Each feedback knowledge point can be Refers to the feedback activities specific to the interception rule vector of the interception strategy, such as business conflict feedback, interception deviation feedback, etc. The knowledge points of forward feedback and backward feedback can reflect the problems at different stages after the interception decision to a certain extent.

In this way, the forward feedback knowledge points and backward feedback knowledge points in the intercepted feedback data are added to different feedback knowledge graphs, and based on the historical frequent item entities of the forward feedback knowledge graph and the backward feedback knowledge graph, each Focus on the combination of forward key knowledge entities and backward key knowledge entities associated with the feedback process, obtain the combined key knowledge entities of each attention feedback process, and generate corresponding interception feedback reference data, which can realize combination association in the data collection process and reduce follow-up The operation processing of manual association is convenient to improve the efficiency of subsequent response measures to optimize the interception strategy.

Based on the same inventive concept, the embodiment of the present application also provides an information interception system. The information interception system 100 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (Central Processing Units, CPU) 112 (eg, one or more processors) and memory 111'. Wherein, the storage 111 may be a short-term storage or a persistent storage. The program stored in the memory 111 may include one or more modules, and each module may include a series of instructions to operate on the information interception system 100 . Further, the central processing unit 112 may be configured to communicate with the memory 111 , and execute a series of instruction operations in the memory 111 on the information interception system 100 .

The information interception system 100 can also include one or more power supplies, one or more communication units 113, one or more input and output interfaces, and/or, one or more operating systems, such as WindowsServerTM, Mac OS XTM, UnixTM, LinuxTM , FreeBSDTM and so on.

In addition, an embodiment of the present application further provides a storage medium, where the storage medium is used to store a computer program, and the computer program is used to execute the method provided in the foregoing embodiments.

The embodiment of the present application also provides a computer program product including instructions, which, when run on a computer, causes the computer to execute the method provided in the foregoing embodiments.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the execution includes: The steps of the above method embodiment; and the aforementioned storage medium can be at least one of the following media: read-only memory (English: Read-only Memory, abbreviation: ROM), RAM, magnetic disk or optical disk, etc. can store medium for program code.

It should be noted that each embodiment in this specification is described in a progressive manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. place. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiments. The device and system embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person familiar with the technical field can easily think of changes or Replacement should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (9)

1. A big data analysis interception method applying artificial intelligence analysis is applied to an information interception system and is characterized by comprising the following steps:

when receiving an access trigger event of a target access activity transmitted in a real-time state by a business service system, generating a corresponding target access trigger event;

according to a first access activity interception decision network, based on the target access trigger event, making a decision to generate a basic interception decision basis related to the target access activity; the first access activity interception decision network is obtained by performing network convergence optimization according to a basic reference data set, wherein the basic reference data set comprises a first reference access trigger event and a basic reference interception basis carried by the first reference access trigger event, and the basic reference interception basis is obtained based on whether an access activity maintaining state is configured in a destruction state after the access activity corresponding to the first reference access trigger event is released;

according to a second access activity interception decision network, based on the target access trigger event, making a decision to generate a further interception decision basis related to the target access activity; the second access activity interception decision network is obtained by performing network convergence optimization according to an advanced reference data set, wherein the advanced reference data set comprises a second reference access trigger event and an advanced reference interception basis carried by the second reference access trigger event, and the advanced reference interception basis represents a tag attribute of an access activity corresponding to the second reference access trigger event;

determining a target interception decision basis associated with the target access activity based on the basic interception decision basis and the advanced interception decision basis; the target interception decision is based on a threat output perspective representing the subject access activity, wherein the threat output perspective of the subject access activity represents whether the subject access activity can be classified as an intercepted access activity;

the first access activity interception decision network and the second access activity interception decision network comprise network parameter layers with the same network weight information;

training the first and second access activity interception decision networks in accordance with:

according to a first basic access activity interception decision network, based on the first reference access trigger event in the basic reference data set, making a decision to generate a first access activity interception decision basis;

determining a first interception prediction cost based on the first access activity interception decision basis and the base reference interception basis in the base reference data set;

performing network convergence optimization on the first basic access activity interception decision network according to the first interception prediction cost;

synchronously configuring the network weight information of the network parameter layer in the first basic access activity interception decision network to the network parameter layer in a second basic access activity interception decision network;

according to the second basic access activity interception decision network, based on the second reference access trigger event in the advanced reference data set, making a decision to generate a second access activity interception decision basis;

determining a second interception prediction cost based on the second access activity interception decision basis and the advanced reference interception basis in the advanced reference data set;

performing network convergence optimization on the second basic access activity interception decision network according to the second interception prediction cost;

synchronously configuring network weight information of the network parameter layer in the second basic access activity interception decision network to the network parameter layer in the first basic access activity interception decision network;

determining a target interception prediction cost based on the first interception prediction cost and the second interception prediction cost;

and combining and optimizing the network convergence of the first basic access activity interception decision network and the second basic access activity interception decision network according to the target interception prediction cost.

2. The big data analysis interception method applying artificial intelligence analysis according to claim 1, wherein the basic reference data set is further added with destruction time series data of an access state corresponding to the first reference access trigger event;

if it is determined that the access activity maintaining state is configured in a destruction state after releasing the access activity corresponding to the first reference access triggering event, classifying the basic reference interception into an interception access activity according to a criterion that the access activity corresponding to the first reference access triggering event is represented, wherein destruction time sequence data of the access state represents time sequence interval information between the access activity corresponding to the first reference access triggering event and a comparison access activity, and the comparison access activity is the last access activity released before the access activity maintaining state is configured in the destruction state;

if the access activity maintaining state is not searched to be configured in the destruction state after the access activity corresponding to the first reference access triggering event is determined to be released, the basic reference interception criterion represents that the access activity corresponding to the first reference access triggering event is classified into the non-intercepted access activity, and the destruction time sequence data of the access state is the time sequence interval value of the non-intercepted access activity.

3. The big data analysis interception method applying artificial intelligence analysis according to claim 2, wherein said decision-making a basic interception decision basis associated with said target access activity based on said target access trigger event according to a first access activity interception decision network comprises:

acquiring destruction time series data of a calibrated access state; the calibrated destruction timing sequence data of the access state is obtained based on the destruction timing sequence data of the access state in the basic reference data set, which is called when the first access activity interception decision network is optimized for network convergence;

and generating the basic interception decision basis based on the targeted access trigger event and the calibrated destruction time sequence data of the access state according to the first access activity interception decision network.

4. The big data analysis interception method applying artificial intelligence analysis according to claim 1, wherein the first access activity interception decision network comprises a first basic description variable mining unit and a first interception decision unit, and the second access activity interception decision network comprises a second basic description variable mining unit and a second interception decision unit;

the step of deciding to generate a basic interception decision basis associated with the target access activity based on the target access trigger event according to the first access activity interception decision network includes:

according to the first basic description variable mining unit, mining a basic description variable corresponding to each access unit in the target access trigger event;

according to the first interception decision unit, based on the basic description variable corresponding to each access unit in the target access trigger event, deciding to generate the basic interception decision basis;

the step of deciding to generate a further interception decision basis associated with the target access activity based on the target access trigger event according to the second access activity interception decision network includes:

according to the second basic description variable mining unit, mining a basic description variable corresponding to each access unit in the target access trigger event;

and deciding to generate the advanced interception decision basis based on the basic description variable corresponding to each access unit in the target access trigger event according to the second interception decision unit.

5. The big data analysis interception method applying artificial intelligence analysis according to claim 1, characterized in that said method further comprises:

acquiring an access trigger event decision network initialized by weight and a third reference data set; the access trigger event decision network is configured to execute a basic access trigger event decision flow, the access trigger event decision network comprising the network parameter layer; the third reference data set comprises a third reference access trigger event and a carried training reference basis, and the training reference basis represents a label attribute of the third reference access trigger event in the access trigger event decision flow;

deciding to generate a third access activity interception decision basis based on the third reference access trigger event in the third reference data set according to the access trigger event decision network; determining a third interception prediction cost based on the third access activity interception decision basis and a training reference basis in the third reference data set;

performing network convergence optimization on the access triggering event decision network according to the third interception prediction cost;

synchronously configuring network weight information of the network parameter layer in the access trigger event decision network to the network parameter layer in the first basic access activity interception decision network or the second basic access activity interception decision network;

determining a target interception prediction cost based on the first interception prediction cost and the second interception prediction cost; and according to the target interception prediction cost, performing network convergence optimization on the first basic access activity interception decision network and the second basic access activity interception decision network in a combined mode, wherein the network convergence optimization comprises the following steps:

determining the target interception prediction cost based on the first interception prediction cost, the second interception prediction cost and the third interception prediction cost;

and according to the target interception prediction cost, combining the first basic access activity interception decision network, the second basic access activity interception decision network and the access trigger event decision network to perform network convergence optimization.

6. The big data analysis interception method applying artificial intelligence analysis according to claim 5, further comprising:

acquiring a description variable mining network with initialized weight and a fourth reference data set; the description variable mining network is configured to mine access description variables corresponding to each access unit in an access triggering event, and comprises the network parameter layer; the fourth reference data set comprises a fourth reference access trigger event;

mining a decision access description variable corresponding to each access unit in the fourth reference access trigger event according to the description variable mining network;

determining a forward extended access unit and a backward extended access unit which are respectively associated with each reference access unit in the fourth reference access trigger event, and determining a fourth interception prediction cost based on a decision access description variable corresponding to each reference access unit in the fourth reference access trigger event, a decision access description variable of the forward extended access unit associated with each reference access unit, and a decision access description variable of the backward extended access unit associated with each reference access unit; performing network convergence optimization on the description variable mining network according to the fourth interception prediction cost;

synchronously configuring network weight information of the network parameter layer in the description variable mining network to the network parameter layer in the first basic access activity interception decision network or the second basic access activity interception decision network;

determining a target interception prediction cost based on the first interception prediction cost and the second interception prediction cost; and according to the target interception prediction cost, performing network convergence optimization on the first basic access activity interception decision network and the second basic access activity interception decision network in a combined mode, wherein the network convergence optimization comprises the following steps:

determining the target interception prediction cost based on the first interception prediction cost, the second interception prediction cost and the fourth interception prediction cost;

and combining the first basic access activity interception decision network, the second basic access activity interception decision network and the description variable mining network to perform network convergence optimization according to the target interception prediction cost.

7. The big data analysis intercepting method applying artificial intelligence analysis according to claim 6, wherein the determining of the respectively associated forward extension access unit and backward extension access unit for each reference access unit in the fourth reference access triggering event comprises:

for each reference access unit in the fourth reference access trigger event, determining the remaining reference access units except the reference access unit in the fourth reference access trigger event, and determining the remaining reference access units as the forward extended access units associated with the reference access units;

for each reference access unit in the fourth reference access trigger event, determining a reference access unit in the rest access trigger events except the fourth reference access trigger event, and determining the reference access unit as a backward extension access unit associated with the reference access unit;

determining a fourth interception prediction cost based on a decision access description variable corresponding to each reference access unit in the fourth reference access trigger event, a decision access description variable of a forward extension access unit associated with each reference access unit, and a decision access description variable of a backward extension access unit associated with each reference access unit, including:

for each reference access unit in the fourth reference access trigger event, forming a forward extension cluster associated with the reference access unit based on the reference access unit and a carried forward extension access unit, and determining a matching value between a decision access description variable of the forward extension access unit in the forward extension cluster and a decision access description variable of the reference access unit, and determining the matching value as a matching value associated with the forward extension cluster;

forming a backward extension cluster associated with the reference access unit based on the reference access unit and a carried backward extension access unit, and determining a matching value between a decision access description variable of the backward extension access unit in the backward extension cluster and a decision access description variable of the reference access unit, wherein the matching value is determined as the matching value associated with the backward extension cluster;

for each reference access unit in the fourth reference access trigger event, determining an extension cost associated with the reference access unit based on a matching value associated with each forward extension cluster associated with the reference access unit and a matching value associated with each backward extension cluster associated with the reference access unit;

determining a fourth interception prediction cost based on the extension cost respectively associated with each reference access unit in the fourth reference access trigger event;

the determining the extension cost associated with the reference access unit based on the matching value associated with each forward extension cluster associated with the reference access unit and the matching value associated with each backward extension cluster associated with the reference access unit includes:

determining a plurality of forward-backward extension clusters associated with the reference access unit according to each forward extension cluster associated with the reference access unit and each backward extension cluster associated with the reference access unit; each forward-backward extension cluster comprises one forward extension cluster and one backward extension cluster;

calculating a difference value between a matching value associated with a forward extension cluster and a matching value associated with a backward extension cluster in the forward and backward extension clusters aiming at each forward and backward extension cluster associated with the reference access unit, and determining the difference value as an extension cost associated with the forward and backward extension clusters;

and determining the extension cost associated with the reference access unit based on the extension costs respectively associated with the forward and backward extension clusters associated with the reference access unit.

8. The big data analysis interception method applying artificial intelligence analysis according to claim 1, characterized in that said method further comprises:

acquiring an access trigger event decision network and a description variable mining network initialized by weight, and a third reference data set and a fourth reference data set; the access trigger event decision network is configured in an access trigger event decision process of an execution basis, the description variable mining network is configured in an access description variable corresponding to each access unit in a mining access trigger event, and the access trigger event decision network and the description variable mining network both comprise the network parameter layer; the third reference data set comprises a third reference access trigger event and a carried training reference basis, and the training reference basis represents a label attribute of the third reference access trigger event in the access trigger event decision flow; the fourth reference data set comprises a fourth reference access trigger event;

deciding to generate a third access activity interception decision basis based on the third reference access trigger event in the third reference data set according to the access trigger event decision network; determining a third interception prediction cost based on the third access activity interception decision basis and a training reference basis in the third reference data set;

according to the third interception prediction cost, carrying out network convergence optimization on the access trigger event decision network;

synchronously configuring network weight information of the network parameter layer in the access trigger event decision network to the network parameter layer in the description variable mining network;

mining a decision access description variable corresponding to each access unit in the fourth reference access trigger event according to the description variable mining network; determining a forward extended access unit and a backward extended access unit which are respectively associated with each reference access unit in the fourth reference access trigger event, and determining a fourth interception prediction cost based on a decision access description variable which is respectively corresponding to each reference access unit in the fourth reference access trigger event, a decision access description variable of the forward extended access unit which is respectively associated with each reference access unit, and a decision access description variable of the backward extended access unit which is respectively associated with each reference access unit;

performing network convergence optimization on the description variable mining network according to the fourth interception prediction cost;

synchronously configuring network weight information of the network parameter layer in the description variable mining network to the network parameter layer in the first basic access activity interception decision network or the second basic access activity interception decision network;

determining a target interception prediction cost based on the first interception prediction cost and the second interception prediction cost; and according to the target interception prediction cost, performing network convergence optimization on the first basic access activity interception decision network and the second basic access activity interception decision network in a combined mode, wherein the network convergence optimization comprises the following steps:

determining the target interception prediction cost based on the first interception prediction cost, the second interception prediction cost, the third interception prediction cost and the fourth interception prediction cost;

and according to the target interception prediction cost, combining the first basic access activity interception decision network, the second basic access activity interception decision network, the access trigger event decision network and the description variable mining network to perform network convergence optimization.

9. An information interception system, comprising:

a processor;

a memory having stored therein a computer program that, when executed, implements the big data analysis intercepting method applying artificial intelligence analysis of any of claims 1-8.

Images