Out-of-distribution network flow data detection method based on calculated likelihood ratio

Abstract

The invention discloses an out-of-distribution network flow data detection method based on a calculated likelihood ratio, and belongs to the field of network flow data detection. The objective of the invention is to improve the accuracy and confidence of network flow data identification. The method comprises the following steps: extracting network traffic characteristics: the original traffic is a pcap packet, is divided into different data streams according to a quintuple, and is set to extract a data packet length sequence, calculate a packet arrival time interval sequence, store the sequences and generate a CSV file as original training data of model training; the method comprises the following steps: training an original classification model by using original training data, training the original classification model by adopting a deep learning algorithm long-short-term memory network to obtain a model trained by the original training data, generating disturbance data, generating disturbance data by adopting a method of adding Gaussian white noise, training a disturbance model, and obtaining a model trained by the disturbance data. And calculating a likelihood ratio, and judging out-of-distribution data. According to the invention, the accuracy and confidence of network traffic data identification are high.

Description

technical field [0001] The invention belongs to the field of network traffic data detection, in particular to a method for detecting out-of-distribution network traffic data based on a calculated likelihood ratio. Background technique [0002] With the increase of network private protocols, the types of network traffic are also more and more, and the similarity is also gradually improved. Many of today's network security problems need to be based on the identification and detection of network traffic. Most of the traditional identification and detection technologies are based on machine learning algorithms or deep learning algorithms to train classification models. [0003] Out-of-distribution data refers to the assumption that there is a data set S, which consists of data (X, Y), where X represents the extracted feature set, and Y represents the data label set. If there is a sample s(x, y) where y does not belong to Y, then the sample s is called out-of-distribution data. ...

AI Technical Summary

Problems solved by technology

However, due to the randomness of how to extract features and the extracted features, there is no standard, and there is a large gap for different types of data, so the calculated distance is not unique.

At the same time, the measurement scales between different features are not the same, and calculating distance or similarity is a very subjective and difficult thing

In addition, it is not easy to set the scale for judging whether it is out-of-distribution data. If the setting is too large or too small, it will easily cause a high false positive rate

Images