Summary of the invention
The embodiment of the present invention provides a kind of IP type mark method and system based on figure convolutional neural networks, to solveIn the prior art to IP classification depend on operator IP list, when IP list update not in time in the case where, specificCan cause to seriously affect to business in network strategy causes user experience bad, while network security is unable to get effective guaranteeThe problem of.
In a first aspect, the embodiment of the present invention provides a kind of IP type mark method based on figure convolutional neural networks, comprising:
The whole network data obtained in preset time period establishes adjacency matrix according to the structural information in the whole network dataAnd eigenmatrix；
The adjacency matrix and the eigenmatrix are input in preset figure convolutional neural networks, described the whole network is obtainedThe classification results of each IP in data.
Second aspect, the embodiment of the present invention provide a kind of IP type mark system based on figure convolutional neural networks, comprising:
Feature construction module, for obtaining the whole network data in preset time period, according to the structure in the whole network dataInformation establishes adjacency matrix and eigenmatrix；
Categorization module, for the adjacency matrix and the eigenmatrix to be input to preset figure convolutional neural networksIn, obtain the classification results of each IP in the whole network data.
The third aspect, the embodiment of the present invention provides a kind of electronic equipment, including memory, processor and is stored in memoryComputer program that is upper and can running on a processor, the processor are realized when executing described program such as above-mentioned first aspect instituteThe step of IP type mark method based on figure convolutional neural networks provided.
Fourth aspect, the embodiment of the present invention provide a kind of non-transient computer readable storage medium, are stored thereon with calculatingMachine program is realized when the computer program is executed by processor and is based on figure convolutional neural networks as provided by above-mentioned first aspectIP type mark method the step of.
IP type mark method and system provided in an embodiment of the present invention based on figure convolutional neural networks, by the whole networkData construct structural information, extract to the characteristic information in figure with structural information, using figure convolutional neural networks to the whole networkIP in information classifies, and the IP segment table provided without operator carries out data supporting, and is classified using whole network data,Feedback can be provided extremely to IP in time, improve internet security.
Specific embodiment
In order to make the object, technical scheme and advantages of the embodiment of the invention clearer, below in conjunction with the embodiment of the present inventionIn attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment isA part of the embodiment of the present invention, instead of all the embodiments.Based on the embodiments of the present invention, those of ordinary skill in the artEvery other embodiment obtained without creative efforts, shall fall within the protection scope of the present invention.
With reference to Fig. 1, Fig. 1 is the IP type mark method based on figure convolutional neural networks that one embodiment of the invention providesFlow diagram, provided method include:
S1 obtains the whole network data in preset time period, according to the structural information in the whole network data, establishes adjacent squareBattle array and eigenmatrix；
Specifically, by obtaining whole network data in a period of time, since whole network data is a dynamic data,Therefore whole network data all in a period can be extracted by the way of time series, whole network data is constituted by savingStructural information of the graph data of point and side composition as whole network data, refering to what is shown in Fig. 2, wherein, the node of structural information canThink the network nodes such as IP, DeviceID, UA, Referer, information exchange and information verification process conduct between different nodesIt side in structural information further can be by information sender to the side as side between structural information interior joint and nodeTo.After obtaining the structural information of whole network data, information further obtains adjacency matrix and eigenmatrix with this configuration,With all vertex datas in an one-dimension array storage figure；The number of relationship (side or arc) between vertex is stored with a two-dimensional arrayAccording to this two-dimensional array is known as adjacency matrix.Adjacency matrix is divided into digraph adjacency matrix and non-directed graph adjacency matrix again.ForThe characteristic for receiving the output of the node and each node in information may be constructed eigenmatrix, adjacency matrix and eigenmatrixThe as input data of figure convolutional neural networks.
The adjacency matrix and the eigenmatrix are input in preset figure convolutional neural networks, described in acquisition by S2The classification results of each IP in whole network data.
Specifically, the adjacency matrix of building and eigenmatrix are input in preset figure convolutional neural networks, picture scroll productNeural network can export by forward direction from level to level and provide probability results in the last layer, and then provide each in whole network dataThe concrete type result of a IP.
By the method, by constructing structural information to whole network data, the characteristic information in figure is carried out with structural informationIt extracts, is classified using figure convolutional neural networks to the IP in the whole network information, the IP segment table provided without operator is countedAccording to support, and classified using whole network data, feedback can be provided extremely IP in time, improves internet security.
On the basis of the above embodiments, the step of whole network data obtained in preset time period, specifically includes: withEach of network verifies node as structural information of event and attribute relevant to the verification time, between nodeData interaction as in structural information side building whole network data structural information.
Specifically, in the step of passing through the whole network acquisition of information structural information, it is first determined the node in structural information leads toVerify data is crossed to obtain structural information, node is verifying event and event relevant attribute node such as IP, DeviceID,The nodes such as UA, the information interactive process in verification information can be obtained as the side in structural information by whole network data structureThe full mesh topology figure built, the structure of as whole network data are new.
By the method, whole network data is subjected to image conversion, and then the whole network number can be obtained on the basis of structural informationAccording to topological diagram in figure characteristic information and structural information, convenient for it is subsequent using picture scroll product to each node in structural information intoRow classification.
On the basis of the above embodiments, described that the adjacency matrix and the eigenmatrix are input to preset picture scrollThe step of accumulating in neural network, obtaining the classification results of each IP in the whole network data specifically includes: will be according to the whole network numberThe adjacency matrix and eigenmatrix that structural information in is established are input in preset figure convolutional neural networks, by presetFigure convolutional neural networks are labeled each of structural information node；Choose IP all in the whole network dataNode extracts the annotation results of each IP node, obtains the classification results of each IP in the whole network data.
Specifically, Fig. 3 is the IP type mark based on figure convolutional neural networks that one embodiment of the invention provides with reference to Fig. 3The input schematic diagram of figure convolutional neural networks in note method.By being input to the eigenmatrix constructed in S1 and adjacency matrixIn preset figure convolutional neural networks, figure convolutional neural networks can be obtained to the qualitative table of each node in structural informationIt counts, is exactly the type that meter goes out IP for IP node, by extracting the annotation results of each of whole network data IP node,And then the classification results of IP in whole network data can be obtained.
On the basis of the above embodiments, described the step of obtaining the classification results of each IP in the whole network data itAfterwards, further includes: according to the classification results of the IP, calculate the confidence level that each IP is exception IP, confidence level is higher than defaultThe classification results of the IP of threshold value are as final IP classification results.
Specifically, since classification results of the figure convolutional neural networks for IP are the probability that IP is normal IP or exception IPOutput, since a part of normal IP is when being classified, will lead to some behaviors, to make the IP have certain probability to regard as differentNormal IP, therefore the concept of confidence level is incorporated herein, in the case that the confidence level that an IP is exception IP is higher than preset threshold,It can determine the IP really for abnormal IP, reduce the misjudged probability of ordinary user, promote user's body of the user in verification processIt tests.
On the basis of the above embodiments, before the whole network data obtained in preset time period the step of, further includes:The whole network data of multiple and different preset time periods is obtained, and each of whole network data node is labeled, is constructedTraining sample set；Figure convolutional neural networks are trained by the training sample set, obtain the preset picture scroll product mindThrough network.
Specifically, being carried out by the whole network data for obtaining multiple and different periods, and to node each in whole network dataData after mark are trained figure convolutional neural networks as training sample set, can obtain default in the present embodimentFigure convolutional neural networks.
By the method, without the IP portrait that third party provides, but the whole network data in network is labeledIt is trained, to obtain IP type identification model, the user experience is improved is differentiated to subsequent IP type.
With reference to Fig. 4, Fig. 4 is the IP type mark system based on figure convolutional neural networks that one embodiment of the invention providesStructural schematic diagram, provided system include: feature construction module 41 and categorization module 42.
Wherein, feature construction module 41 is used to obtain the whole network data in preset time period, according in the whole network dataStructural information, establish adjacency matrix and eigenmatrix.
Categorization module 42 is used to the adjacency matrix and the eigenmatrix being input to preset figure convolutional neural networksIn, obtain the classification results of each IP in the whole network data.
Specifically, by obtaining whole network data in a period of time, since whole network data is a dynamic data,Therefore whole network data all in a period can be extracted by the way of time series, whole network data is constituted by savingStructural information of the graph data of point and side composition as whole network data, refering to what is shown in Fig. 2, wherein, the node of structural information canThink the network nodes such as IP, DeviceID, UA, Referer, information exchange and information verification process conduct between different nodesIt side in structural information further can be by information sender to the side as side between structural information interior joint and nodeTo.After obtaining the structural information of whole network data, information further obtains adjacency matrix and eigenmatrix with this configuration,With all vertex datas in an one-dimension array storage figure；The number of relationship (side or arc) between vertex is stored with a two-dimensional arrayAccording to this two-dimensional array is known as adjacency matrix.Adjacency matrix is divided into digraph adjacency matrix and non-directed graph adjacency matrix again.ForThe characteristic for receiving the output of the node and each node in information may be constructed eigenmatrix, adjacency matrix and eigenmatrixThe as input data of figure convolutional neural networks.
The adjacency matrix of building and eigenmatrix are input in preset figure convolutional neural networks, figure convolutional neural networksIt can be exported by forward direction from level to level and provide probability results in the last layer, and then provide the tool of each IP in whole network dataBody types results.
By this system, by constructing structural information to whole network data, the characteristic information in figure is carried out with structural informationIt extracts, is classified using figure convolutional neural networks to the IP in the whole network information, the IP segment table provided without operator is countedAccording to support, and classified using whole network data, feedback can be provided extremely IP in time, improves internet security.
On the basis of the above embodiments, the system also includes confidence level modules, for the classification knot according to the IPFruit calculates the confidence level that each IP is exception IP, and confidence level is higher than the classification results of the IP of preset threshold as final IPClassification results.
Specifically, since classification results of the figure convolutional neural networks for IP are the probability that IP is normal IP or exception IPOutput, since a part of normal IP is when being classified, will lead to some behaviors, to make the IP have certain probability to regard as differentNormal IP, therefore the concept of confidence level is incorporated herein, in the case that the confidence level that an IP is exception IP is higher than preset threshold,It can determine the IP really for abnormal IP, reduce the misjudged probability of ordinary user, promote user's body of the user in verification processIt tests.
On the basis of the above embodiments, the system also includes training modules, for obtaining multiple and different preset timesThe whole network data of section, and each of whole network data node is labeled, construct training sample set；Pass through the instructionPractice sample set to be trained the preset figure convolutional neural networks.
By obtaining the whole network data of multiple and different periods, and after being labeled to node each in whole network dataData are trained figure convolutional neural networks as training sample set, can obtain the preset picture scroll product in the present embodimentNeural network.
By this system, without the IP portrait that third party provides, but the whole network data in network is labeledIt is trained, to obtain IP type identification model, the user experience is improved is differentiated to subsequent IP type.
Fig. 5 is the structural schematic diagram for the electronic equipment that one embodiment of the invention provides, as shown in figure 5, provided electronicsEquipment includes: processor (processor) 501,502, memory communication interface (Communications Interface)(memory) 503 and bus 504, wherein processor 501, communication interface 502, memory 503 are completed mutually by bus 504Between communication.Processor 501 can call the logical order in memory 503, to execute following method, for example, obtainWhole network data in preset time period establishes adjacency matrix and eigenmatrix according to the structural information in the whole network data；It willThe adjacency matrix and the eigenmatrix are input in preset figure convolutional neural networks, are obtained each in the whole network dataThe classification results of a IP.
The embodiment of the present invention discloses a kind of computer program product, and computer program product includes being stored in non-transient calculatingComputer program on machine readable storage medium storing program for executing, computer program include program instruction, when program instruction is computer-executed,Computer is able to carry out method provided by above-mentioned each method embodiment, for example, obtains the whole network number in preset time periodAccording to establishing adjacency matrix and eigenmatrix according to the structural information in the whole network data；By the adjacency matrix and the spyInput matrix is levied into preset figure convolutional neural networks, obtains the classification results of each IP in the whole network data.
The present embodiment provides a kind of non-transient computer readable storage medium, non-transient computer readable storage medium storagesComputer instruction, computer instruction make computer execute method provided by above-mentioned each method embodiment, for example, obtain pre-If the whole network data in the period establishes adjacency matrix and eigenmatrix according to the structural information in the whole network data；By instituteIt states adjacency matrix and the eigenmatrix is input in preset figure convolutional neural networks, obtain each in the whole network dataThe classification results of IP.
The apparatus embodiments described above are merely exemplary, wherein described, unit can as illustrated by the separation memberIt is physically separated with being or may not be, component shown as a unit may or may not be physics listMember, it can it is in one place, or may be distributed over multiple network units.It can be selected according to the actual needsIn some or all of the modules achieve the purpose of the solution of this embodiment.Those of ordinary skill in the art are not paying creativenessLabour in the case where, it can understand and implement.
Through the above description of the embodiments, those skilled in the art can be understood that each embodiment canIt realizes by means of software and necessary general hardware platform, naturally it is also possible to pass through hardware.Based on this understanding, onStating technical solution, substantially the part that contributes to existing technology can be embodied in the form of software products in other words, shouldComputer software product may be stored in a computer readable storage medium, such as ROM/RAM, magnetic disk, CD, including several fingersIt enables and using so that a computer equipment (can be personal computer, server or the network equipment etc.) executes each implementationMethod described in certain parts of example or embodiment.
Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, rather than its limitations；AlthoughPresent invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that: it still may be usedTo modify the technical solutions described in the foregoing embodiments or equivalent replacement of some of the technical features；And these are modified or replaceed, technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution spirit andRange.