CN115378856B - Communication detection method, device and storage medium - Google Patents

Abstract

The invention discloses a communication detection method, equipment and a storage medium, wherein the method is characterized in that an information source for assisting a target to be detected in communication detection is selected from network equipment by utilizing the similarity among data according to a communication detection task, the network equipment comprises the Internet of things and equipment in a network center of the Internet of things, communication data of the target to be detected and communication data of the information source are input into a communication detection model for communication detection, a communication detection result of the target to be detected aiming at a communication category is obtained, and the communication detection model is trained based on a first loss function representing distribution information and importance of each information source and a second loss function representing spatial gathering of the target to be detected and the information source. The invention realizes the complementation of the information between the information source and the target to be detected by using the information carried by the information source as an aid so as to improve the detection accuracy of the communication data of the target to be detected.

Description

Communication detection method, equipment and storage medium

technical field

The present application relates to the technical field of the Internet of Things, in particular to a communication detection method, device, equipment and storage medium.

Background technique

With the advancement of IoT technology, more and more IoT devices are currently being used in people's daily production and life. These rich IoT devices have also enabled transformation and breakthroughs in many important fields, such as smart road networking and car networking. The equipment supports smart cities and smart transportation, and the smart medical IoT equipment supports more accurate and humanized smart medical care. Since the computing power of IoT devices is relatively weak, the use of IoT devices often requires the cooperation of a network center that can carry large-scale data computing and storage tasks that cannot be easily completed by IoT devices.

Both the Internet of Things and its network center involve a large number of network communications. Therefore, it is very necessary to realize the detection of the communication of the Internet of Things and its network center. Communication detection for the Internet of Things and its network center can be varied. For example, the detection of communication content can be used for content statistics and usage analysis of the communication of the Internet of Things and its network center, etc. For example, the detection of communication security can be used to analyze which communications of the Internet of Things and its network center are normal communication, which ones are abnormal communication, so as to ensure the security of IoT devices and their network centers. Therefore, an accurate and efficient Internet of Things and its network center communication detection method is very necessary, which can be used for the analysis of the usage mode of the Internet of Things and its network center, and for its security supervision and monitoring, etc. This ensures that the Internet of Things and its network centers operate in an efficient and reliable manner.

However, there are differences in the communication between IoT devices and between IoT devices, and between IoT and its network center in operation. For example, the communication performed by IoT devices is more about data transmission, while the communication performed by IoT centers may be more biased towards computing and storage-related communication. Therefore, the communication faced by different IoT devices and the communication faced by the network center have their own strengths, but they are not very comprehensive. For example, for a group of IoT devices, if the communication data captured by the party to be tested for communication is not rich enough, it will cause a large deviation between the detected result and the actual result, which will affect the effect of communication detection.

Contents of the invention

In view of this, the present application provides a communication detection method, device, device and storage medium to solve the problem of poor communication detection effect of existing network devices such as the Internet of Things and its network center.

In order to solve the above technical problems, a technical solution adopted by this application is to provide a communication detection method, including: receiving a communication detection task, the communication detection task includes the target to be tested, the communication category and the network device where the target to be tested is located; The similarity between the first communication data corresponding to the communication category of the measured target and the second communication data corresponding to the communication category of other targets in the network device is obtained by screening the information source from other targets; the first communication data and the second communication data of the information source 3. The communication data is input into the communication detection model for communication detection, and the communication detection results of the target to be tested are obtained for the communication category. The communication detection model includes a feature extraction network and a global public detector. The feature extraction network and the global public detector are based on characterizing each The first loss function of information source distribution information and its importance and the second loss function representing the spatial aggregation of the device under test and the information source are obtained through training.

As a further improvement of the present application, based on the similarity between the first communication data corresponding to the communication category of the target to be tested and the second communication data corresponding to the communication category of other targets in the network device, information sources are obtained from other targets, including : Obtain the first communication data of the target to be tested and the second communication data of other targets, and use the feature extraction network to extract the first communication vector from the first communication data, and extract the second communication vector from the second communication data ; According to the first data distribution of the first communication data in each communication category, and the second data distribution of the second communication data in each communication category, the statistics are obtained; all other objects are sorted according to the statistics to obtain the distribution ranking; The Euclidean distance between the first mean vector of each communication category of a communication vector and the second mean vector of each second communication vector in each communication category is averaged to obtain the average Euclidean distance; according to the average Euclidean distance for all other targets Sorting is performed to obtain a European ranking; the final ranking of all other objects is confirmed according to the distribution ranking and the European ranking, and a first preset number of other objects are selected as information sources according to the final ranking.

As a further improvement of the present application, the training of the communication detection model specifically includes: respectively inputting the first communication sample data of the target to be tested and the second communication sample data of the information source into the feature extraction network for extraction, and obtaining the first communication sample vector and The second communication sample vector; using the first communication sample vector and the second communication sample vector to calculate the weight of each information source; respectively input the first communication sample vector and the second communication sample vector to the global public detector for distribution prediction, Obtain the first predicted distribution vector of the target to be tested in each communication category and the second predicted distribution vector of the information source in each communication category; according to the first predicted distribution vector, the second predicted distribution vector, weight, the first communication sample vector, the second predicted distribution vector The second communication sample vector, the first loss function and the second loss function are calculated to obtain the loss function value; the feature extraction network and the global public detector are iteratively trained according to the loss function value and the preset optimization algorithm.

As a further improvement of the present application, the weight of each information source is calculated by using the first communication sample vector and the second communication sample vector, including: calculating the first mean value vector of the first communication sample vector in each communication category and each second The Euclidean distance of the communication sample vectors between the second mean vectors of each communication category is averaged to obtain the average Euclidean distance; the weight of the information source is calculated according to the average Euclidean distance corresponding to each information source, and the calculation formula of the weight is expressed as:

Among them, ω _j represents the weight of the jth information source, and dist _j represents the average Euclidean distance between the jth information source and the target to be tested.

As a further improvement of the present application, calculating the first loss function value of the first loss function includes: calculating the first forecast distribution mean vector according to the first forecast distribution vector; calculating the information according to the first forecast distribution mean vector and the second forecast distribution vector KL divergence between the source and the target to be measured; calculate the first loss function value according to the first prediction distribution mean vector, KL divergence, and weight.

其中，/>

表示第一预测分布均值向量，|x^(k)|表示属于第k类通讯类别的通讯数据的数量，C()表示全局公共检测器，f(x)表示特征提取网络，/>

表示第一预测分布向量，T表示温度参数；As a further improvement of the present application, the formula for calculating the mean vector of the first forecast distribution is:

where, />

Indicates the mean vector of the first prediction distribution, |x ^(k) | indicates the number of communication data belonging to the kth communication category, C() indicates the global public detector, f(x) indicates the feature extraction network, />

Represents the first forecast distribution vector, T represents the temperature parameter;

其中，/>

表示第j个信息源与待测目标分布信息之间的KL散度，/>

表示第二预测分布向量；The calculation formula of KL divergence is:

where, />

Indicates the KL divergence between the jth information source and the target distribution information to be measured, />

represents the second predictive distribution vector;

其中，LI为第一损失函数值，k表示通讯类别的数量，n表示信息源的数量，ω_j表示第j个信息源的权重，|χ_D|表示第一通讯样本数据的数量，L_ce()表示交叉熵损失，y_i表示通讯检测类别标签。The calculation formula of the first loss function value is:

Among them, LI is the first loss function value, k represents the number of communication categories, n represents the number of information sources, ω _j represents the weight of the jth information source, |χ _D | represents the number of first communication sample data, L _ce ( ) represents the cross-entropy loss, and _{y i} represents the communication detection category label.

As a further improvement of the present application, calculating the second loss function value of the second loss function includes: merging the second communication sample data of all information sources into the third communication sample data, and combining the first communication sample data of the target to be tested Merge with the second communication sample data of all information sources into the fourth communication sample data; use the feature extraction network to extract the third communication sample vector and the fourth communication sample vector respectively from the third communication sample data and the fourth communication sample data; Calculate the first average vector, the third average vector, and the fourth average vector of the first communication sample vector, the third communication sample vector, and the fourth communication sample vector in each communication category; calculate the first average vector, the third average vector, The Euclidean distance between the fourth mean value vectors is summed to obtain the first Euclidean distance loss function value; the clustering algorithm is used to select the second preset number of first communication sample vectors from the first communication sample vectors of each communication category. Feature points, select a second preset number of second feature points from the third communication sample vector of each communication category; calculate the Euclidean distance between the first feature point and the second feature point, and take the average to obtain the second feature point Two Euclidean distance loss function values; the second loss function value is calculated according to the first Euclidean distance loss function value and the second Euclidean distance loss function value.

As a further improvement of the present application, the calculation formula of the first Euclidean distance loss function value is:

表示第一均值向量，/>

表示第三均值向量，/>

表示第四均值向量，k表示通讯类别的数量，/>

表示欧式距离；Among them, LG represents the first Euclidean distance loss function value,

represents the first mean vector, />

represents the third mean vector, />

Represents the fourth mean vector, k represents the number of communication categories, />

Indicates the Euclidean distance;

The formula for calculating the value of the second Euclidean distance loss function is:

表示第一通讯样本向量中选取的R个第i类通讯类别的第一特征点中的第n个，/>

表示第三通讯样本向量中选取的R个第i类通讯类别的第二特征点中的第m个。Among them, LL represents the second Euclidean distance loss function value, R represents the second preset number,

Represents the nth one of the first feature points of the R i-th communication categories selected in the first communication sample vector, />

Represents the mth of the second feature points of the R i-th communication categories selected in the third communication sample vector.

In order to solve the above technical problems, another technical solution adopted by the present application is to provide a communication detection device, including: a receiving module for receiving communication detection tasks, and the communication detection tasks include the target to be tested, the communication category and the target to be tested. A network device; a selection module, which is used to screen and obtain information sources from other targets based on the similarity between the first communication data corresponding to the communication category of the target to be tested and the second communication data corresponding to the communication category of other targets in the network device The prediction module is used to input the first communication data and the third communication data of the information source into the communication detection model for communication detection, and obtain the communication detection result of the target to be tested for the communication category. The communication detection model includes a feature extraction network and a global The public detector, the feature extraction network and the global public detector are trained based on the first loss function that characterizes the distribution information and importance of each information source and the second loss function that characterizes the spatial aggregation of the device under test and the information source get.

In order to solve the above technical problems, another technical solution adopted by the present application is to provide a computer device, the computer device includes a processor, a memory coupled to the processor, and program instructions are stored in the memory, so When the program instructions are executed by the processor, the processor is made to perform the steps of any one of the communication detection methods described above.

In order to solve the above-mentioned technical problems, another technical solution adopted by the present application is to provide a storage medium storing program instructions capable of implementing any of the above-mentioned communication detection methods.

The beneficial effect of the present application is: the communication detection method of the present application selects the information source used to assist the target to be tested in the communication detection by using the similarity between the data according to the communication detection task, and the network equipment includes the Internet of Things and The equipment in its network center then inputs the communication data of the target to be tested and the communication data of the information source into the communication detection model for communication detection, and obtains the communication detection results of the target to be tested for the communication category. The communication detection model is based on characterizing each The first loss function of the distribution information of an information source and its importance and the second loss function representing the spatial aggregation of the target to be tested and the information source are trained, so that when detecting the communication data of the target to be tested, the information source can be used as the Auxiliary, using the complementary information between the information source and the target to be tested, helps to detect the communication data of the target to be tested in a more refined manner, improves the detection effect of the communication data of the target to be tested, and improves the detection accuracy.

Description of drawings

FIG. 1 is a schematic flow chart of a communication detection method according to an embodiment of the present invention;

2 is a schematic diagram of functional modules of a communication detection device according to an embodiment of the present invention;

Fig. 3 is a schematic structural diagram of a computer device according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a storage medium according to an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

The terms "first", "second", and "third" in this application are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, features defined as "first", "second", and "third" may explicitly or implicitly include at least one of these features. In the description of the present application, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined. All directional indications (such as up, down, left, right, front, back...) in the embodiments of the present application are only used to explain the relative positional relationship between the various components in a certain posture (as shown in the drawings) , sports conditions, etc., if the specific posture changes, the directional indication also changes accordingly. Furthermore, the terms "include" and "have", as well as any variations thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes unlisted steps or units, or optionally further includes For other steps or units inherent in these processes, methods, products or apparatuses.

Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The occurrences of this phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is understood explicitly and implicitly by those skilled in the art that the embodiments described herein can be combined with other embodiments.

The communication detection method of this embodiment is applied to network devices in the Internet of Things and its network center, and the network devices include but not limited to computers, mobile phones, tablets, and the like. However, because the computing power of network devices in the Internet of Things is relatively weak, the use of network devices in the Internet of Things often requires the cooperation of a network center that can carry large-scale data calculations that cannot be easily completed by Internet of Things network devices. , storage and other tasks. What needs to be understood is that the Internet of Things and network devices in its network center can complement each other in different scenarios, and can be regarded as an information source with rich communication detection information or a target to be tested with insufficient communication detection information. The target is not limited to one device, it can also be a device cluster with the same configuration, or the network center of the Internet of Things, similarly, the information source can also be a device or a device cluster with the same configuration, or It is the network center of the Internet of Things. Complementary in this embodiment means that the network equipment in the Internet of Things, or the network center of the Internet of Things may become an information source in some communication detection scenarios, that is, the party that provides assistance in the communication detection process, and in other communication detection In the detection scenario, it may become the target to be tested, that is, the party that needs help during the communication detection process. Therefore, a relationship of complementary advantages is formed between the Internet of Things network device and the Internet of Things network device, and between the Internet of Things network device and the network center. Based on this complementary relationship of advantages, the present invention proposes a communication detection method to achieve more accurate communication detection of the target to be tested.

FIG. 1 is a schematic flowchart of a communication detection method according to an embodiment of the present invention. It should be noted that the method of the present invention is not limited to the flow sequence shown in FIG. 1 if substantially the same result is obtained. As shown in Figure 1, the communication detection method includes steps:

Step S101: Receive a communication detection task, the communication detection task includes a target to be tested, a communication category, and a network device where the target to be tested is located.

Specifically, it should be noted that the network equipment refers to the equipment in the Internet of Things and its network center. In this embodiment, the communication detection task refers to the detection of data on the equipment in the Internet of Things, and based on the difference in communication detection tasks, The data on the network device can be divided into multiple communication categories. For example, when the communication detection task is intrusion data detection, the communication category is divided into the communication intrusion category, and the intrusion data in the device needs to be detected by communication. When the communication detection task is When the access data is detected, the communication category is classified as a communication access category, and communication detection needs to be performed on the access data in the device.

Step S102: Based on the similarity between the first communication data corresponding to the communication category of the target to be tested and the second communication data corresponding to the communication category of other targets in the network device, obtain information sources from other targets.

Specifically, after receiving the communication detection task, in order to improve the detection effect of the target to be tested, it is necessary to select information sources from the Internet of Things to assist in the detection of communication data of the target to be tested. Information sources are screened through the data similarity between the communication data of the target to be tested and other targets in the Internet of Things.

Further, step S102 specifically includes:

1. Obtain the first communication data of the target to be tested and the second communication data of other targets, and use the feature extraction network to extract the first communication vector from the first communication data, and extract the second communication vector from the second communication data.

Specifically, the data of the target to be tested is input into the feature extraction network, and the first communication vector is extracted, and all other network devices in the Internet of Things and its network center except the target to be tested are used as other targets, and each other communication data of the target, and input the communication data to the feature extraction network to extract the second communication vector.

2. Calculate and obtain statistics according to the first data distribution of the first communication data in each communication category and the second data distribution of the second communication data in each communication category.

It should be noted that the communication data generated by the network device usually includes multiple communication categories, and each communication category includes multiple data. Specifically, after obtaining the first communication data, the distribution of the communication data of the target to be tested can be obtained by counting the number of data of each communication category of the target to be tested. For example, 100 pieces of communication data of the target to be tested belong to Class A communications, 600 belong to Class B communications, and so on. Thus, the first data distribution of the first communication data in each communication category and the second data distribution of the second communication data in each communication category are obtained, and then the statistics are calculated based on the chi-square goodness of fit detection method. It should be noted that the communication category in this embodiment refers to the communication category shared by the first communication data and the second communication data.

The formula for calculating this statistic is:

Wherein, ^χ represents a statistic, k is the number of communication categories, O _i is the number of communication data of the communication data of the i-type communication category for the communication data of the information source, and E _i is the i-th category of communication data for the target communication data to be measured. The number of communication data.

3. Sort all other targets according to the statistics to get the distribution sort.

Specifically, after obtaining the statistic, confirm the other targets corresponding to each statistic, and then sort all other targets in ascending order according to the statistic, so as to obtain the distribution ranking.

4. Calculate the Euclidean distance between the first mean value vector of the first communication vector in each communication category and the second mean value vector of each second communication vector in each communication category and take the mean value to obtain the average Euclidean distance.

其中，l表示平均欧式距离，k表示通讯类别的数目，/>

表示信息源第i类通讯类别的通讯数据的均值，/>

表示待测目标第i类通讯类别的通讯数据的均值Specifically, the formula for calculating the average Euclidean distance is:

Among them, l represents the average Euclidean distance, k represents the number of communication categories, />

Indicates the mean value of the communication data of the i-th communication category of the information source, />

Indicates the mean value of the communication data of the i-th communication category of the target to be tested

5. Sort all other objects according to the average Euclidean distance to obtain a Euclidean ranking.

Specifically, after the average Euclidean distance corresponding to each information source is obtained, the information sources are sorted in ascending order according to the average Euclidean distance to obtain the Euclidean sorting.

6. Confirm the final ranking of all other objects according to the distribution ranking and European ranking, and select a first preset number of other objects as information sources according to the final ranking.

Specifically, for each other target, confirm its corresponding first serial number in the distribution sorting, and confirm its second serial number in the European sorting, and use the average of the first serial number and the second serial number as the final sorting serial number, so as to obtain The final ranking of each other object, and then selecting a first preset number of other objects from the final ranking as information sources. It should be noted that the first preset number is preset, such as 2, 5, and so on.

In this embodiment, by using an information source that is relatively similar to the target to be tested, the target to be tested can be better assisted to perform more accurate communication detection.

Step S103: Input the first communication data and the third communication data of the information source into the communication detection model for communication detection, and obtain the communication detection results of the target to be tested for the communication category. The communication detection model includes a feature extraction network and a global public detector , the feature extraction network and the global public detector are trained based on the first loss function that characterizes the distribution information and importance of each information source and the second loss function that characterizes the spatial aggregation of the device under test and the information source.

Specifically, after obtaining the first communication data and the third communication data of the information source, input the first communication data and the third communication data into the communication detection model for communication detection, and obtain the communication detection result of the target to be tested for the communication type .

It should be noted that the communication detection model includes a feature extraction network and a global public detector. In order to ensure the detection effect of the communication detection model, the feature extraction network and the global public detector are based on the first-order representation of the distribution information and importance of each information source. A loss function and a second loss function representing the space aggregation of the test target and the information source of the device under test are obtained through training.

Further, train the communication detection model, specifically including:

1. Input the first communication sample data of the target to be tested and the second communication sample data of the information source into the feature extraction network for extraction, and obtain the first communication sample vector and the second communication sample vector.

In this embodiment, it should be understood that the communication data generated by different devices in the Internet of Things may have different dimensions. For example, the information source is a vehicle-mounted Internet of Vehicles device, and its communication data is a 10-dimensional vector, while the Internet of Things network center ( The communication data of the target to be tested) may be a 160-dimensional vector. Therefore, the embodiment of the present invention needs to construct a feature extraction network, which includes a two-layer fully connected neural network, and adopts an activation function including but not limited to ReLU. Further, in this embodiment, the number of feature extraction networks is the same as the total number of objects to be tested and information sources, and each feature extraction network is responsible for extracting communication vectors from communication data of a device.

Specifically, before performing communication detection on a certain network device in the Internet of Things, the network device is used as the target to be tested, the network device specified based on preset rules is used as the information source, and the communication data of the information source is used as an auxiliary to improve The detection effect of the communication data of the target to be tested. After obtaining the first communication sample data of the target to be tested and the second communication sample data of the information source, the feature extraction network is used to extract the first communication sample data and the second communication sample data to obtain the first communication sample vector and the second communication sample data respectively. sample vector.

2. Using the first communication sample vector and the second communication sample vector to calculate the weight of each information source.

It should be noted that, in order to weight the information sources to reflect the importance of each information source, that is, the degree to which the information source transmits the communication detection information to the target to be tested, the algorithm will use the characteristic between the information source and the target to be tested Spatial differences are used for weight assignment.

Specifically, the weight of each information source is calculated by using the first communication sample vector and the second communication sample vector, including:

2.1. Calculate the Euclidean distance between the first mean value vector of the first communication sample vector in each communication category and the second mean value vector of each second communication sample vector in each communication category and take the mean value to obtain the average Euclidean distance.

Specifically, for the calculation method of the average Euclidean distance, please refer to the above, which will not be repeated here.

2.2. Calculate the weight of the information source according to the average Euclidean distance corresponding to each information source. The formula for calculating the weight is expressed as:

Among them, ω _j represents the weight of the jth information source, and dist _j represents the average Euclidean distance between the jth information source and the target to be tested.

In this embodiment, the weight calculated according to the above weight calculation formula is within the range of [0.75, 1.25], which makes it impossible for the information source to have a weight of 0 even if the distance between the information source and the target to be measured is relatively close, so that Lose influence on the target under test. In addition, when the distance between the information source and the target to be tested is relatively small, the weight is small, which means that the target to be tested has already obtained the communication detection information delivered by the information source more fully. Therefore, the information source is given a The relatively small weight reflects its small importance; on the contrary, when the information source is far away from the target to be tested, the weight is large, which means that the target to be tested has not yet fully obtained the information conveyed by the information source. Communication detection information, therefore, the information source is given a relatively large weight to enhance its importance, so that the target to be tested can better grasp the communication detection information possessed by the information source.

3. Input the first communication sample vector and the second communication sample vector to the global public detector for distribution prediction, and obtain the first prediction distribution vector of the target to be tested in each communication category and the second prediction of the information source in each communication category distribution vector.

Specifically, after the original communication data of the information source and the target to be tested are mapped to the global feature space through the feature extraction network, the global common detector is used for detection.

4. Calculate the loss function value according to the first prediction distribution vector, the second prediction distribution vector, the weight, the first communication sample vector, the second communication sample vector, the first loss function, and the second loss function.

Specifically, the first loss function is used to represent the distribution information of different information sources and their importance, and the second loss function represents the aggregation of the communication data of the information source and the communication data of the target to be measured from the perspective of spatial characteristics.

Further, calculating the first loss function value of the first loss function includes:

4.11 Calculate the first predictive distribution mean vector according to the first predictive distribution vector.

其中，/>

表示第一预测分布均值向量，|χ^(k)|表示属于第k类通讯类别的通讯数据的数量，C()表示全局公共检测器，f(x)表示特征提取网络，/>

表示第一预测分布向量，T表示温度参数。Among them, the calculation formula of the mean vector of the first forecast distribution is:

where, />

Represents the mean vector of the first prediction distribution, |χ ^(k) | represents the number of communication data belonging to the kth communication category, C() represents the global public detector, f(x) represents the feature extraction network, />

Represents the first predicted distribution vector, T represents the temperature parameter.

4.12 Calculate the KL divergence between the information source and the target to be measured according to the first predictive distribution mean vector and the second predictive distribution vector.

其中，/>

表示第j个信息源与待测目标分布信息之间的KL散度，/>

表示第二预测分布向量。Among them, the calculation formula of KL divergence is:

where, />

Indicates the KL divergence between the jth information source and the target distribution information to be measured, />

represents the second predictive distribution vector.

4.13. Calculate the first loss function value according to the first prediction distribution mean vector, KL divergence, and weight.

其中，LI为第一损失函数值，k表示通讯类别的数量，n表示信息源的数量，ω_j表示第j个信息源的权重，|χ_D|表示第一通讯样本数据的数量，L_ce()表示交叉熵损失，y_i表示通讯检测类别标签。Among them, the calculation formula of the first loss function value is:

Among them, LI is the first loss function value, k represents the number of communication categories, n represents the number of information sources, ω _j represents the weight of the jth information source, |χ _D | represents the number of first communication sample data, L _ce ( ) represents the cross-entropy loss, and _{y i} represents the communication detection category label.

In this embodiment, the distribution information can be transferred from the information-rich information source to the target to be tested during the communication detection process, and the weight can be added to dynamically reflect the importance of the information in the information source, so as to better realize accurate communication detection.

Further, calculating the second loss function value of the second loss function includes:

4.21. Combine the second communication sample data of all information sources into the third communication sample data, and combine the first communication sample data of the target to be tested and the second communication sample data of all information sources into the fourth communication sample data.

Specifically, firstly, the communication detection information transfer between the information source and the target to be tested is assisted from the perspective of feature space distance.

4.22. Extract the third communication sample vector and the fourth communication sample vector from the third communication sample data and the fourth communication sample data respectively by using the feature extraction network.

4.23. Calculate the first average vector, the third average vector, and the fourth average vector of the first communication sample vector, the third communication sample vector, and the fourth communication sample vector in each communication category, respectively.

Specifically, each communication category corresponds to at least one piece of communication data, and the mean value vector of each communication category can be obtained by taking the mean value of the vectors corresponding to all the communication data.

4.24. Calculate the Euclidean distance between the first mean vector, the third mean vector, and the fourth mean vector, and then sum them to obtain the first Euclidean distance loss function value.

Among them, the calculation formula of the first Euclidean distance loss function value is:

表示第一均值向量，/>

表示第三均值向量，/>

表示第四均值向量，k表示通讯类别的数量，/>

表示欧式距离。Among them, LG represents the first Euclidean distance loss function value,

represents the first mean vector, />

represents the third mean vector, />

Represents the fourth mean vector, k represents the number of communication categories, />

represents the Euclidean distance.

4.25. Use a clustering algorithm to select a second preset number of first feature points from the first communication sample vectors of each communication category, and select a second preset number of second feature points from the third communication sample vectors of each communication category. Feature points.

It should be noted that it is also necessary to spatially gather information sources and targets to be measured from the perspective of local representative points. Wherein, the clustering algorithm includes but not limited to the clustering algorithm of Kmeans++.

4.26. Calculate the Euclidean distance between the first feature point and the second feature point, and take the average to obtain the second Euclidean distance loss function value.

Among them, the calculation formula of the second Euclidean distance loss function value is:

表示第一通讯样本向量中选取的R个第i类通讯类别的第一特征点中的第n个，/>

表示第三通讯样本向量中选取的R个第i类通讯类别的第二特征点中的第m个。Among them, LL represents the second Euclidean distance loss function value, R represents the second preset number,

Represents the nth one of the first feature points of the R i-th communication categories selected in the first communication sample vector, />

Represents the mth of the second feature points of the R i-th communication categories selected in the third communication sample vector.

4.27. Calculate the second loss function value according to the first Euclidean distance loss function value and the second Euclidean distance loss function value.

Specifically, the second loss function value=the first Euclidean distance loss function value+the second Euclidean distance loss function value.

5. Iteratively train the feature extraction network and the global public detector according to the loss function value and the preset optimization algorithm.

Specifically, the preset optimization algorithm includes but is not limited to optimization algorithms such as stochastic gradient descent method.

According to the communication detection method of this embodiment, the similarity between the data is used to select the information source from the network equipment to assist the target to be tested to perform communication detection according to the communication detection task. The network equipment includes the Internet of Things and its network center. equipment, and then input the communication data of the target to be tested and the communication data of the information source into the communication detection model for communication detection, and obtain the communication detection results of the target to be tested for the communication category. The communication detection model is based on the distribution information representing each information source The first loss function of its importance and the second loss function representing the spatial aggregation of the target to be tested and the information source are trained, so that when detecting the communication data of the target to be tested, the information source can be used as an auxiliary, and the information source can be used Complementary information with the target to be tested helps to detect the communication data of the target to be tested in a more refined manner, improves the detection effect of the communication data of the target to be tested, and improves the detection accuracy.

FIG. 2 is a schematic diagram of functional modules of a communication detection device according to an embodiment of the present invention. As shown in FIG. 2 , the communication detection device 20 includes a receiving module 21 , a selection module 22 and a prediction module 23 .

The receiving module 21 is used to receive the communication detection task, and the communication detection task includes the target to be tested, the communication category and the network device where the target to be tested is located; the selection module 22 is used to correspond to the first communication data and The similarity between the second communication data corresponding to the communication category of other targets in the network device is obtained by screening the information source from other targets; the prediction module 23 is used to input the first communication data and the third communication data of the information source into the communication The detection model performs communication detection and obtains the communication detection results of the target to be tested for the communication category. The communication detection model includes a feature extraction network and a global public detector. The feature extraction network and the global public detector are based on characterizing the distribution information of each information source and its The first loss function of importance and the second loss function representing the spatial aggregation of the target of the device under test and the information source are obtained through training.

Optionally, the selection module 22 performs screening to obtain information sources from other targets based on the similarity between the first communication data corresponding to the communication category of the target to be tested and the second communication data corresponding to the communication category of other targets in the network device, Including: obtaining the first communication data of the target to be tested and the second communication data of other targets, and using the feature extraction network to extract the first communication vector from the first communication data, and extract the second communication vector from the second communication data; according to The first data distribution of the first communication data in each communication category and the second data distribution of the second communication data in each communication category are calculated to obtain statistics; all other objects are sorted according to the statistics to obtain a distribution ranking; the first communication is calculated The Euclidean distance between the first mean vector of the vector in each communication category and the second mean vector of each second communication vector in each communication category is averaged to obtain the average Euclidean distance; all other objects are sorted according to the average Euclidean distance , to obtain the European ranking; confirm the final ranking of all other objects according to the distribution ranking and the European ranking, and select a first preset number of other objects as information sources according to the final ranking.

Optionally, the communication detection device 20 also includes a training module for training the communication detection model, which specifically includes: inputting the first communication sample data of the target to be tested and the second communication sample data of the information source into the feature extraction network for Extract to obtain the first communication sample vector and the second communication sample vector; use the first communication sample vector and the second communication sample vector to calculate the weight of each information source; input the first communication sample vector and the second communication sample vector respectively Go to the global public detector for distribution prediction, and obtain the first predicted distribution vector of the target to be tested in each communication category and the second predicted distribution vector of the information source in each communication category; according to the first predicted distribution vector, the second predicted distribution vector, The weight, the first communication sample vector, the second communication sample vector, the first loss function and the second loss function are calculated to obtain the loss function value; the feature extraction network and the global public detector are iteratively trained according to the loss function value and the preset optimization algorithm .

Optionally, the training module executes the calculation using the first communication sample vector and the second communication sample vector to obtain the weight of each information source, including: calculating the first mean value vector and each second communication sample vector of the first communication sample vector in each communication category The Euclidean distance of the communication sample vectors between the second mean vectors of each communication category is averaged to obtain the average Euclidean distance; the weight of the information source is calculated according to the average Euclidean distance corresponding to each information source, and the calculation formula of the weight is expressed as:

Among them, ω _j represents the weight of the jth information source, and dist _j represents the average Euclidean distance between the jth information source and the target to be tested.

Optionally, the operation of the training module to calculate the first loss function value of the first loss function specifically includes: calculating the first forecast distribution mean vector according to the first forecast distribution vector; calculating the first forecast distribution mean vector and the second forecast distribution vector KL divergence between the information source and the target to be measured; calculate the first loss function value according to the first prediction distribution mean vector, KL divergence, and weight.

其中，/>

表示第一预测分布均值向量，|χ^(k)|表示属于第k类通讯类别的通讯数据的数量，C()表示全局公共检测器，f(x)表示特征提取网络，/>

表示第一预测分布向量，T表示温度参数；Optionally, the formula for calculating the mean vector of the first forecast distribution is:

where, />

Represents the mean vector of the first prediction distribution, |χ ^(k) | represents the number of communication data belonging to the kth communication category, C() represents the global public detector, f(x) represents the feature extraction network, />

Represents the first forecast distribution vector, T represents the temperature parameter;

其中，/>

表示第j个信息源与待测目标分布信息之间的KL散度，/>

表示第二预测分布向量；The calculation formula of KL divergence is:

where, />

Indicates the KL divergence between the jth information source and the target distribution information to be measured, />

represents the second predictive distribution vector;

其中，LI为第一损失函数值，k表示通讯类别的数量，n表示信息源的数量，ω_j表示第j个信息源的权重，|χ_D|表示第一通讯样本数据的数量，L_ce()表示交叉熵损失，y_i表示通讯检测类别标签。The calculation formula of the first loss function value is:

Among them, LI is the first loss function value, k represents the number of communication categories, n represents the number of information sources, ω _j represents the weight of the jth information source, |χ _D | represents the number of first communication sample data, L _ce ( ) represents the cross-entropy loss, and _{y i} represents the communication detection category label.

Optionally, the operation of the training module to calculate the second loss function value of the second loss function specifically includes: combining the second communication sample data of all information sources into the third communication sample data, and combining the first communication sample data of the target to be tested The sample data and the second communication sample data of all information sources are merged into the fourth communication sample data; the third communication sample vector and the fourth communication sample vector are respectively extracted from the third communication sample data and the fourth communication sample data by using the feature extraction network Vector; respectively calculate the first average vector, the third average vector, and the fourth average vector of the first communication sample vector, the third communication sample vector, and the fourth communication sample vector in each communication category; calculate the first average vector, the third average The Euclidean distance between two vectors and the fourth mean value vector is summed to obtain the value of the first Euclidean distance loss function; the clustering algorithm is used to select the second preset number from the first communication sample vector of each communication category The first feature point, selecting a second preset number of second feature points from the third communication sample vector of each communication category; calculating the Euclidean distance between the first feature point and the second feature point, and taking the average, Obtaining the second Euclidean distance loss function value; calculating the second loss function value according to the first Euclidean distance loss function value and the second Euclidean distance loss function value.

Optionally, the formula for calculating the value of the first Euclidean distance loss function is:

表示第一均值向量，/>

表示第三均值向量，/>

表示第四均值向量，k表示通讯类别的数量，/>

表示欧式距离；Among them, LG represents the first Euclidean distance loss function value,

represents the first mean vector, />

represents the third mean vector, />

Represents the fourth mean vector, k represents the number of communication categories, />

Indicates the Euclidean distance;

The formula for calculating the value of the second Euclidean distance loss function is:

表示第一通讯样本向量中选取的R个第i类通讯类别的第一特征点中的第n个，/>

表示第三通讯样本向量中选取的R个第i类通讯类别的第二特征点中的第m个。Among them, LL represents the second Euclidean distance loss function value, R represents the second preset number,

Represents the nth one of the first feature points of the R i-th communication categories selected in the first communication sample vector, />

Represents the mth of the second feature points of the R i-th communication categories selected in the third communication sample vector.

For other details about the implementation of the technical solution of each module in the communication detection device of the above embodiment, refer to the description of the communication detection method in the above embodiment, which will not be repeated here.

It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. For the same and similar parts in each embodiment, refer to each other, that is, Can. As for the device-type embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to part of the description of the method embodiments.

Please refer to FIG. 3 . FIG. 3 is a schematic structural diagram of a computer device according to an embodiment of the present invention. As shown in FIG. 3 , the computer device 30 includes a processor 31 and a memory 32 coupled to the processor 31. Program instructions are stored in the memory 32. When the program instructions are executed by the processor 31, the processor 31 executes any of the above-mentioned operations. The steps of the communication detection method described in the embodiment.

Wherein, the processor 31 may also be referred to as a CPU (Central Processing Unit, central processing unit). The processor 31 may be an integrated circuit chip with signal processing capabilities. The processor 31 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components . A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

Referring to FIG. 4 , FIG. 4 is a schematic structural diagram of a storage medium according to an embodiment of the present invention. The storage medium in the embodiment of the present invention stores program instructions 41 capable of realizing the above-mentioned communication detection method, wherein the program instructions 41 may be stored in the above-mentioned storage medium in the form of software products, including several instructions to make a computer device ( It may be a personal computer, a server, or a network device, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-OnlyMemory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes, Or computer equipment such as computers, servers, mobile phones, and tablets.

In the several embodiments provided in this application, it should be understood that the disclosed computer equipment, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units. The above is only the implementation mode of this application, and does not limit the scope of patents of this application. Any equivalent structure or equivalent process transformation made by using the contents of this application specification and drawings, or directly or indirectly used in other related technical fields, All are included in the scope of patent protection of the present application in the same way.

Claims (10)

1. A method of communication detection, the method comprising:

receiving a communication detection task, wherein the communication detection task comprises a target to be detected, a communication category and network equipment where the target to be detected is located;

screening information sources from other targets based on the similarity between the first communication data corresponding to the communication category of the target to be detected and the second communication data corresponding to the communication category of the other targets in the network equipment;

inputting the first communication data and the third communication data of the information sources into a communication detection model for communication detection to obtain a communication detection result of the target to be detected aiming at the communication category, wherein the communication detection model comprises a feature extraction network and a global public detector, and the feature extraction network and the global public detector are trained and obtained based on a first loss function representing the distribution information of each information source and the importance of the information sources and a second loss function representing the spatial gathering of the target to be detected and the information sources.

2. The communication detection method according to claim 1, wherein the screening the information source from the other targets based on the similarity between the first communication data corresponding to the communication category of the target to be detected and the second communication data corresponding to the communication category of the other targets in the network device includes:

Acquiring the first communication data of the target to be detected and second communication data of other targets, extracting a first communication vector from the first communication data by utilizing the characteristic extraction network, and extracting a second communication vector from the second communication data;

obtaining statistics according to first data distribution of the first communication data in each communication category and second data distribution of the second communication data in each communication category;

sorting all other targets according to the statistics to obtain distribution sorting;

calculating Euclidean distance between a first average value vector of the first communication vector in each communication category and a second average value vector of each second communication vector in each communication category, and taking an average value to obtain an average Euclidean distance;

sorting all other targets according to the average Euclidean distance to obtain Euclidean sorting;

and confirming the final ordering of all other targets according to the distribution ordering and the European ordering, and selecting a first preset number of other targets as the information sources according to the final ordering.

3. The communication detection method according to claim 1, wherein training the communication detection model specifically comprises:

Respectively inputting the first communication sample data of the target to be detected and the second communication sample data of the information source into the feature extraction network for extraction to obtain a first communication sample vector and a second communication sample vector;

calculating the weight of each information source by using the first communication sample vector and the second communication sample vector;

the first communication sample vector and the second communication sample vector are respectively input to the global public detector to conduct distribution prediction, so that a first prediction distribution vector of the target to be detected in each communication category and a second prediction distribution vector of the information source in each communication category are obtained;

calculating a loss function value according to the first prediction distribution vector, the second prediction distribution vector, the weight, the first communication sample vector, the second communication sample vector, the first loss function and the second loss function;

and carrying out iterative training on the feature extraction network and the global public detector according to the loss function value and a preset optimization algorithm.

4. The communication detection method according to claim 3, wherein the calculating the weight of each information source using the first communication sample vector and the second communication sample vector includes:

Calculating Euclidean distance between a first average value vector of the first communication sample vector in each communication category and a second average value vector of each second communication sample vector in each communication category, and taking an average value to obtain an average Euclidean distance;

calculating the weight of each information source according to the average Euclidean distance corresponding to the information source, wherein the calculation formula of the weight is expressed as follows:

wherein omega _j Representing the weight of the jth information source, dist _j And representing the average Euclidean distance between the jth information source and the target to be detected.

5. The communication detection method of claim 3, wherein calculating a first loss function value of the first loss function comprises:

calculating a first prediction distribution mean vector according to the first prediction distribution vector;

calculating KL divergence between the information source and the target to be detected according to the first prediction distribution mean value vector and the second prediction distribution vector;

and calculating the first loss function value according to the first prediction distribution mean vector, the KL divergence and the weight.

6. The communication detection method according to claim 5, wherein the calculation formula of the first prediction distribution mean vector is:

Wherein (1)>

Representing said first predictive distribution mean vector,/->

Representing the number of communication data belonging to the k-th communication class, C () representing said global common detector, f (x) representing said feature extraction network,/->

Representing the first predicted distribution vector, T representing a temperature parameter;

the calculation formula of the KL divergence is as follows:

wherein (1)>

Indicating KL divergence between jth information source and distribution information of target to be detected,/for>

Representing the second predicted distribution vector;

the calculation formula of the first loss function value is as follows:

wherein LI is the first loss function value, k represents the number of communication categories, n represents the number of information sources, ω _j Weight representing the jth information source, < ->

Indicating the number of the first communication sample data, L _ce () Representing cross entropy loss, y _i And a communication detection type label is indicated.

7. The communication detection method according to claim 3, wherein calculating a second loss function value of the second loss function comprises:

merging the second communication sample data of all the information sources into third communication sample data, and merging the first communication sample data of the target to be detected and the second communication sample data of all the information sources into fourth communication sample data;

Extracting a third communication sample vector and a fourth communication sample vector from the third communication sample data and the fourth communication sample data respectively by utilizing the characteristic extraction network;

respectively calculating a first average value vector, a third average value vector and a fourth average value vector of the first communication sample vector, the third communication sample vector and the fourth communication sample vector in each communication category;

calculating Euclidean distances between the first mean value vector, the third mean value vector and the fourth mean value vector, and summing to obtain a first Euclidean distance loss function value;

a clustering algorithm is utilized to respectively select a second preset number of first characteristic points from the first communication sample vectors of all the communication categories, and select the second preset number of second characteristic points from the third communication sample vectors of all the communication categories;

calculating Euclidean distances between the first characteristic points and the second characteristic points, and averaging to obtain a second Euclidean distance loss function value;

and calculating the second loss function value according to the first Euclidean distance loss function value and the second Euclidean distance loss function value.

8. The communication detection method according to claim 7, wherein the first euclidean distance loss function value is calculated by the following formula:

wherein LG represents the first Euclidean distance loss function value,

representing the first mean vector, +.>

Representing the third mean vector, +.>

Representing the fourth mean vector, k representing the number of communication categories, +.>

Representing the Euclidean distance;

the calculation formula of the second Euclidean distance loss function value is as follows:

wherein LL represents the second euclidean distance loss function value, R represents the second preset number,

n-th,/in the first feature points representing the selected R i-th communication categories in the first communication sample vector>

And representing the mth of the second characteristic points of the R ith communication categories selected from the third communication sample vector.

9. A computer device comprising a processor, a memory coupled to the processor, the memory having stored therein program instructions that, when executed by the processor, cause the processor to perform the steps of the communication detection method of any of claims 1-8.

10. A storage medium storing program instructions capable of implementing the communication detection method according to any one of claims 1 to 8.

Images