Model training method, device and equipment for multi-level system and storage medium

Abstract

The invention relates to a model training method, device and equipment for a multi-level system and a storage medium, and the method comprises the steps that a first-level system sends a to-be-trained network attack detection model to each second-level system, and each second-level system trains the network attack detection model according to local network attack data, the trained model parameters are sent to a first-stage system; the first-stage system aggregates the received multiple model parameters to generate target model parameters, updates a network attack detection model according to the target model parameters, and sends the updated network attack detection model to each second-stage system; and repeating the steps until a preset stop condition is met, and generating the network attack detection model by the first-stage system according to the current target model parameter. According to the technical scheme provided by the invention, the method is applied to a multi-level privacy environment, and the accuracy of a network attack detection model is ensured while the data privacy is protected.

Description

technical field [0001] The present disclosure relates to the technical field of artificial intelligence, and in particular to a model training method, device, device and storage medium for a multi-level system. Background technique [0002] As the network security situation continues to change, the construction of network security situational awareness is continuing in various industries. The situational awareness platform is the technical support for security operations. The situational awareness platform can discover and evaluate the current network security situation through threat analysis and alarms on massive security logs or events. For some large-scale regulatory units or large group companies, a situational awareness system with linkage between upper and lower levels is usually established to form a unified monitoring mode for subordinate units. [0003] At present, the upper-level platform uniformly collects the network attack data of each lower-level platform and...

AI Technical Summary

Problems solved by technology

However, in some scenarios with high data privacy protection requirements, the upper-level platform cannot obtain the data of the lower-level platform due to reasons such as confidentiality and sensitivity, and the upper-level platform cannot perform adaptive tuning of the detection model based on the data of the lower-level platform, and network attack detection is accurate. degree to be improved,

Images