Network traffic anomaly detection and classification method based on LSTM-EWC

Abstract

The invention discloses a network traffic anomaly detection and classification method based on LSTM-EWC. The method comprises the following steps: S1, data preprocessing; s2, feature selection; s3, model building and training; and S4, evaluating the performance of the model. According to the invention, the EWC algorithm is utilized to solidify LSTM model parameters within a certain range, an efficient LSTM-EWC model capable of continuously learning network traffic features is developed, and efficient detection and classification of network data streams with dynamically changed features are realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of deep learning, and more specifically, relates to a network traffic anomaly detection and classification method based on LSTM-EWC. Background Art

[0002] With the rapid development of the Internet, network traffic has shown an exponential growth, resulting in an increasingly complex and diverse network environment. In the face of increasingly complex network threats, implementing effective anomaly detection and classification strategies is the key to ensuring the safe and stable operation of network systems. Traditional anomaly detection methods rely on manual feature extraction and rule matching, which is difficult to cope with increasingly complex attack methods and diverse network environments. Deep learning technology, especially neural network-based methods, provides new solutions for processing and analyzing large-scale network traffic data.

[0003] In 1997, Sepp Hochreiter and Jürgen Schmidhuber proposed an anomaly detection method based on the Long Short-Term Memory (LSTM) network. LSTM can effectively capture long-term dependencies in time series data and is widely used in the detection of network traffic data with time series relationships. However, when using the LSTM model alone, when training a new task, there is usually no data from the old task to help the model preserve the features of the old task, or because of over-adaptation to the data of the new task, catastrophic forgetting and other problems will occur, that is, when learning a new pattern, the model will forget the previously learned knowledge. In addition, in network traffic anomaly detection, the LSTM model may need to be updated frequently to adapt to the changing data type, which may cause the model to forget the normal and abnormal traffic features previously learned. Therefore, introducing a certain model parameter solidification mechanism to prevent the LSTM model from having catastrophic forgetting problems has become a research focus of current machine learning.

[0004] Therefore, a new LSTM-EWC-based network traffic anomaly detection and classification method is urgently needed. Summary of the invention

[0005] In order to overcome the shortcomings of the prior art, the present invention provides a network traffic anomaly detection and classification method based on LSTM-EWC, and intends to introduce an elastic weight consolidation (Elastic Weight Consolidation, EWC) algorithm to solve the catastrophic forgetting problem that may occur in the LSTM model when the data type changes dynamically. The EWC algorithm was proposed by Kirkpatrick et al. in 2017. EWC protects important parameters by adding regularization terms to the loss function to prevent the model from forgetting old knowledge during the update process. The present invention uses the EWC algorithm to solidify the LSTM model parameters within a certain range, develops an efficient LSTM-EWC model that can continuously learn network traffic characteristics, and realizes efficient detection and classification of network data flows with dynamically changing characteristics.

[0006] The technical solution to achieve the purpose of the present invention is to provide a network traffic anomaly detection and classification method based on LSTM-EWC, comprising the following steps:

[0007] S1. Data preprocessing, obtaining the original network traffic dataset X original , the original network traffic dataset X original Contains the characteristics of network traffic and marks the type label of network traffic; for the original network traffic dataset X original Perform data cleaning and normalize the characteristic data of network traffic to obtain a new data set X new ;

[0008] S2. Feature selection: construct a CART decision tree, select the top P features that have a greater impact on network traffic anomaly identification from the network traffic feature list Feature, and construct the target data set X target , and the target dataset X target Divide into training set, validation set and test set;

[0009] S3. Model building and training: constructing an LSTM-EWC model for network traffic anomaly detection and classification; training the LSTM model with the training set data and saving the parameter set θ′ of the final model; initializing the EWC model and adjusting the parameters of the LSTM-EWC model with the validation set to obtain a new parameter set Update the LSTM model;

[0010] S4. Model performance evaluation, the test set data is used to evaluate the detection and classification performance of the LSTM-EWC model and calculate the classification evaluation index.

[0011] Among them, S1 specifically includes the following steps:

[0012] S11. Obtain network traffic data;

[0013] Select the original network traffic dataset X original =[X 1 ,X 2 ,…,X n ,…,X N ] T , where X n =[x n,1 ,x n,2 ,…,x n,k ,…,x n,K ] T represents the nth data vector of length K, x n,k represents the kth eigenvalue in the nth data vector, n = 1, 2, ..., N, k = 1, 2, ..., K, the total number of data vectors is N, the number of features of each data vector is K, marking the type of each network traffic, z n Indicates the type label of the nth data;

[0014] Let data feature set Feature = {f 1 ,f 2 ,…,f k ,…,f K ,f Label}, where f k Indicates the kth feature name of network traffic data, f Label Represents the network traffic label; the category label set of network traffic data is Label = {l 1 ,l 2 ,…,l m ,…,l M}, where l m Indicates the mth type label of network traffic data, the total number of type labels is M, z n ∈Label;

[0015] S12. Data cleaning: Use the duplicated function, isnull function, and z-score function in the Pycharm tool to check the original network traffic data set X original Check whether there are duplicate data, missing data, or abnormal data in the data vector. If so, delete the data vector; use label encoding to digitize discrete category features and label data;

[0016] S13. Data normalization;

[0017] After cleaning the data set Min-max normalization is performed to scale the data values ​​to the interval [0,1].

[0018] Among them, S2 specifically includes the following steps:

[0019] S21. Initialize CART decision tree;

[0020] S22. Select the optimal splitting feature and splitting point of the current node;

[0021] S23. Divide the data set according to the optimal splitting feature and splitting point to generate child nodes;

[0022] S24. Determine whether the node branch of the CART decision tree stops;

[0023] S25. Select features and construct a target data set;

[0024] Feature selection based on feature importance.

[0025] Preferably, S21 specifically includes the following steps: let the root node data set of the CART decision tree be the normalized new data set X new ; The maximum depth of the decision tree is H max , the minimum number of samples in the child node data set is Q min , the node is labeled d;

[0026] Initialize the depth of the CART decision tree to H = 1, the root node number is d = 0, and the root node data set is X 0 =X new .

[0027] Preferably, S22 specifically includes the following steps: let the current node, that is, the data set labeled d, be in, No. The type label of the data is Feature set Feature = {f 1 ,f 2 ,…,f K ,f Label}, label set Label = {l 1 ,l 2 ,…,l m ,…,l M}, Indicates the number of nodes in the current node data set. The length of the data is K samples.

[0028] Preferably, S23 specifically includes the following steps: according to the optimal splitting feature f * and split point α * Set the current node's dataset X d Split into two subsets X left and X right, respectively as the data sets of the left and right child nodes of the current node, the left node is labeled d left =2×d+1, the label of the right node is d right =2×d+2; let the depth of the CART decision tree be H=H+1.

[0029] Preferably, S24 specifically includes the following steps: checking whether the depth H of the CART tree reaches a preset maximum value H max :

[0030] If so, the node branch stops and the CART decision tree is constructed;

[0031] If not, further check the two child node data sets X left and X right Is the number of data samples less than the preset minimum value Q? min ;

[0032] If so, the node branch stops and the CART decision tree is constructed;

[0033] If not, calculate the two child node data sets X according to formula (4) left and X right The Gini index of is to determine whether it is a positive value;

[0034] If not, the node branch stops and the CART decision tree construction is completed;

[0035] If so, use data set X left and X right As the new current node, repeat steps 2-2 to 2-4 and continue node splitting until the CART decision tree is built.

[0036] Among them, S3 specifically includes the following steps:

[0037] S31. Build LSTM model;

[0038] S32. Initialize LSTM model parameters;

[0039] S33. Train LSTM model;

[0040] S34. Construct EWC model;

[0041] S35. Use the EWC model to modify the LSTM model parameters to form a new LSTM model.

[0042] According to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the steps in the LSTM-EWC-based network traffic anomaly detection and classification method of the present invention are implemented.

[0043] According to another aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the LSTM-EWC-based network traffic anomaly detection and classification method of the present invention are implemented.

[0044] Compared with the prior art, the present invention has at least the following beneficial effects:

[0045] The present invention uses the EWC algorithm to solidify the LSTM model parameters within a certain range, develops an efficient LSTM-EWC model that can continuously learn network traffic characteristics, and realizes efficient detection and classification of network data flows with dynamically changing characteristics.

[0046] The present invention can not only learn the long-term dependencies of network traffic data, but also enable the model to retain previously learned knowledge when continuously learning multiple tasks. The method of the present invention is based on the traditional LSTM model. First, the original data set is preprocessed, and a CART decision tree model is established to select features that have a greater impact on the type of network traffic, and a target data set is constructed, which is divided into the first task (training set), the second task (validation set) and the test set; then an LSTM model is established, and the model is trained using the training set data, and the parameters of the model are retained; then an LSTM-EWC model is established, and the EWC model is initialized with the parameters of the old model, and the validation set is used to train to obtain the final model; finally, the performance of the model is evaluated using the test set data. The method of the present invention reduces the computational and communication overhead of the traditional LSTM model through the CART decision tree. At the same time, the method of combining LSTM and EWC protects important parameters, and improves the overall detection performance while preventing the model from being forgotten. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments will be briefly introduced below. Obviously, the drawings in the following description only relate to some embodiments of the present invention, but are not intended to limit the present invention.

[0048] Figure 1 is a method flow chart of a preferred embodiment of the present invention;

[0049] Figure 2 It is a flow chart of CART decision tree algorithm in a preferred embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of an LSTM model in a preferred embodiment of the present invention;

[0051] Figure 4 It is an algorithm flow chart of the LSTM-EWC method in a preferred embodiment of the present invention;

[0052] Figure 5 It is a schematic diagram of simulation results in a preferred embodiment of the present invention;

[0053] Figure 6 It is a schematic diagram of simulation results in a preferred embodiment of the present invention;

[0054] Figure 7 It is a schematic diagram of simulation results in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0055] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0056] Unless otherwise defined, technical or scientific terms used herein shall have the same meaning as commonly understood by one of ordinary skill in the art to which the invention belongs.

[0057] The following is combined with Figure 1-7 The specific embodiments of the present invention are described in detail with examples.

[0058] Embodiment 1: The present invention provides the following technical solution, a network traffic anomaly detection and classification method based on LSTM-EWC,

[0059] Step 1: Data preprocessing to obtain the original network traffic data set X original , the dataset contains the characteristics of network traffic and the type labels of network traffic; for the original dataset X original Perform data cleaning and normalize the characteristic data of network traffic to obtain a new data set X new .

[0060] Step 2: Feature selection. Construct a CART decision tree and select the top P features that have the greatest impact on network traffic anomaly identification from the network traffic feature list Feature to construct the target data set X target , and the target dataset X target Divide into training set, validation set and test set.

[0061] Step 3: Model building and training. Construct an LSTM-EWC model for network traffic anomaly detection and classification. Train the LSTM model using the training set data and save the parameter set θ′ of the final model. Initialize the EWC model and adjust the parameters of the LSTM-EWC model using the validation set to obtain a new parameter set. Update the LSTM model.

[0062] Step 4: Model performance evaluation: Use the test set data to evaluate the detection and classification performance of the LSTM-EWC model and calculate the classification evaluation index.

[0063] Furthermore, in step 1, the data preprocessing is specifically described as follows:

[0064] Step 1-1 obtain network traffic data;

[0065] Select the original network traffic dataset X original =[X 1 ,X 2 ,…,X n ,…,X N ] T , where X n =[x n,1 ,x n,2 ,…,x n,k ,…,x n,K ] T represents the nth data vector of length K, x n,k Indicates the kth eigenvalue in the nth data vector, n = 1, 2, ..., N, k = 1, 2, ..., K, the total number of data vectors is N, and the number of features of each data vector is K. Mark the type of each network traffic, z n Indicates the type label of the nth piece of data.

[0066] Let data feature set Feature = {f 1 ,f 2 ,…,f k ,…,f K ,f Label}, where f k Indicates the kth feature name of network traffic data, f Label Represents the network traffic label. The category label set of network traffic data is Label = {l 1 ,l 2 ,…,l m ,…,l M}, where l m Indicates the mth type label of network traffic data, the total number of type labels is M, z n ∈Label.

[0067] The goal of this invention is to build and train an LSTM-EWC model to implement network traffic data type label z n Based on the label distribution, it is determined whether the network is abnormal and what kind of abnormality occurs.

[0068] Step 1-2: Data cleaning;

[0069] Use the duplicated function, isnull function, and z-score function in the Pycharm tool to check the original network traffic data set X original Check whether there are duplicate data, missing data, or abnormal data in the data vector. If so, delete the data vector; use label encoding to digitize discrete category features and label data. The cleaned data set is in Indicates the first A data vector with strip length K, Indicates the first The kth eigenvalue in the data vector, Indicates the first The type label of the data, the total number of data vectors after cleaning is

[0070] Step 1-3: Data normalization;

[0071] After cleaning the data set Perform minimum-maximum normalization to scale the data values ​​to the [0,1] interval. The specific method is as follows: for any feature f k , 1≤k≤K, and its corresponding data vector According to formula (2), it is normalized and converted into data value

[0072]

[0073] in, Represents data vector Medium data feature f k The corresponding value, Represents feature f k The maximum value of the corresponding data, Represents feature f k The minimum value of the corresponding data.

[0074] Define the normalized new data set as in Represents the normalized A data vector with strip length K, After normalization, The kth eigenvalue in the data vector, After normalization, The type label of the data; network traffic feature set Feature = {f 1 ,f 2 ,…,f K ,f Label}, network traffic type label set Label = {l 1 ,l 2 ,…,l m ,…,l M},

[0075] Furthermore, in step 2, the feature selection is specifically described as follows:

[0076] Step 2-1: Initialize the CART decision tree;

[0077] Let the root node data set of the CART decision tree be the normalized new data set X new ; The maximum depth of the decision tree is H max , the minimum number of samples in the child node data set is Q min , the node is labeled d.

[0078] Initialize the depth of the CART decision tree to H = 1, the root node number is d = 0, and the root node data set is X 0 =X new .

[0079] Step 2-2: Select the optimal splitting feature and splitting point of the current node;

[0080] Let the current node, that is, the data set labeled d, be in, No. The type label of the data is Feature set Feature = {f 1 ,f 2 ,…,f K ,f Label}, label set Label = {l 1 ,l 2 ,…,l m ,…,l M}, Indicates the number of nodes in the current node data set. The length of the data is K samples.

[0081] Calculate the current node data set X d In each feature f k and the Gini index Gini(X d ,f k ,α), Select the feature and split point that minimizes the Gini index as the best split feature f * and the optimal split point α * The specific steps are:

[0082] Step 2-2-1: According to the feature f k and split point α will node data set X d Split into X temp1 and X temp2 Two data subsets, feature f k Corresponding data sample set Satisfied The data samples are divided into data subsets X temp1 ,satisfy The data samples are divided into data subsets X temp2 . Calculate the Gini index Gini (X d ,f k ,α):

[0083]

[0084] Among them, |X d |、|X temp1 | and |X temp2 | respectively represent the current node data set X d , data subset X temp1 and X temp2 The number of data samples. Gini(X temp1 ) and Gini(X temp2 ) can be calculated by formula (4):

[0085]

[0086] Among them, p m,q In the dataset X q The proportion of data samples with label m.

[0087] Step 2-2-2: Select a set of eigenvalues ​​and potential split points that minimize the Gini index as the optimal split feature f * and split point α * ,Right now

[0088]

[0089] Step 2-3: Divide the data set according to the optimal splitting features and splitting points to generate child nodes;

[0090] According to the best split feature f * and split point α * Set the current node's dataset X d Split into two subsets X left and d right , respectively as the data sets of the left and right child nodes of the current node, the left node is labeled d left=2×d+1, the label of the right node is d right =2×d+2; let the depth of the CART decision tree be H=H+1.

[0091] Step 2-4: Determine whether the node branch of the CART decision tree stops;

[0092] Check whether the depth H of the CART tree reaches the preset maximum value H max :

[0093] If so, the node branch stops and the CART decision tree is constructed;

[0094] If not, further check the two child node data sets X left and X right Is the number of data samples less than the preset minimum value Q? min ;

[0095] If so, the node branch stops and the CART decision tree is constructed;

[0096] If not, calculate the two child node data sets X according to formula (4) left and X right The Gini index of is to determine whether it is a positive value;

[0097] If not, the node branch stops and the CART decision tree construction is completed;

[0098] If so, use data set X left and X right As the new current node, repeat steps 2-2 to 2-4 and continue node splitting until the CART decision tree is built.

[0099] Step 2-5: Select features and build target dataset;

[0100] Feature selection based on feature importance. Define feature importance as a certain feature The sum of the reduced Gini index when the best splitting feature is selected during the decision tree splitting process is calculated as follows:

[0101] Step 2-5-1: Calculate the optimal split feature f * At a single optimal split point α * The reduction in the Gini index at is:

[0102] ΔGini(f * ,α * )=Gini(X d )-Gini(X d ,f * ,α * ) (6)

[0103] Step 2-5-2: The best split feature f * At all optimal split points α * The reduction of the Gini index at the position is accumulated to obtain the characteristic f * Importance:

[0104]

[0105] Where α is the optimal split feature f * The optimal split point α at all nodes in the decision tree construction process * A collection of .

[0106] Select the first P features with greater importance, and use the normalized sample data of these P features to form the target data set in Represents the target dataset X target Middle data vector, Indicates The pth eigenvalue in the target data vector; Indicates Type label for the entry data vector.

[0107] Step 2-6: Dataset division;

[0108] The target dataset X target The data vector is divided into training set X according to a given ratio train , validation set X val and the test set X test Among them, X train Used to train LSTM model; X val Used to train the EWC model and adjust the parameters of the LSTM model; X test Used for final evaluation of model performance.

[0109] Furthermore, in step 3, the model building and training are described in detail as follows:

[0110] Step 3-1: Build LSTM model;

[0111] The LSTM model consists of a forget gate, an input gate, a cell state, a hidden state, and an output gate.

[0112] Forget gate: determines which information in the cell state needs to be discarded; the output vector g of the forget gate at time step t t Calculated as

[0113] g t =σ(W g ·[h t-1 ,X t ]+bg ) (8)

[0114] Input gate: determines what new information needs to be added to the cell state; the output vector i of the input gate at time step t t Calculated as

[0115] i t =σ(W i ·[h t-1 ,X t ]+b i ) (9)

[0116] Cell state: Let the cell state at time step t be C t , which is calculated as

[0117]

[0118] Output gate: determines which parts of the cell state will affect the hidden state; the output vector o of the output gate at time step t t Calculated as

[0119] o t =σ(W o ·[h t-1 ,X t ]+b o ) (12)

[0120] Hidden state: The hidden state h of the cell at time t t Updated to

[0121] h t =o t *tanh(C t ) (13)

[0122] Among them, X t represents the data matrix input at time step t, (W g , b g )、(W i , b i )、(W C , b C )、(W o , b o ) represent the weight matrix and bias of the input gate, forget gate, cell state and output gate respectively, represents the candidate cell state, C t-1 and h t-1 represents the cell state and hidden state at time step (t-1), σ(.) and tanh(.) represent the Sigmoid and Tanh activation functions respectively, and their calculation formulas are as shown in equations (14) and (15):

[0123]

[0124] Fully connected layer: The output of LSTM is passed to the fully connected layer for final classification; the output of the fully connected layer for

[0125]

[0126] Among them, h T represents the hidden state of LSTM at the last time step; σ(.) represents the Sigmoid activation function; W os and b os is the weight matrix and output bias vector of the fully connected layer; It represents the probability that the i-th network traffic is predicted to be the m-th class label.

[0127] Step 3-2: Initialize LSTM model parameters;

[0128] Initialize the parameters required for LSTM model training, including the input dimension input dim , hidden layer dimension hidden dim , the number of neurons neurons, the output dimension output dim , number of stacked layers layers num , batch size batch, number of iterations epochs, time step t, target loss value

[0129] Step 3-3: Train the LSTM model;

[0130] Using training set X train Train the LSTM model. in Represents the training set X train The i-th training data vector in represents the kth eigenvalue of the i-th training vector; represents the type label of the i-th training vector, Represents the distribution of the type label of the i-th training vector. If but The rest of the distribution is 0.

[0131] The specific training steps are as follows:

[0132] Step 3-3-1: Initialize the model parameter set θ 0 ={θ 0,1 ,θ 0,2 ,…,θ 0,j ,…,θ 0,J}, where θ0 Denote the set of weight matrices, bias vectors, and the weights and biases of the fully connected layer inside the LSTM model as θ 0,j Denote the parameter set θ 0 The j-th parameter of, and the total number of parameters is J = (input dim + hidden dim ) * 4 * hidden dim + 4 * hidden dim + 10. Initialize the weights and biases in the LSTM using Xavier initialization. The weight matrices follow a normal distribution with mean 0 and variance , and the biases are initialized as all-zero vectors; Initialize the prediction loss value to reach the target value

[0133] Step 3 - 3 - 2: Forward propagation. Input the t eigenvalue of batch data vectors according to the batch size batch and the time step t in sequence, that is t < P. Calculate the output vector through the forward propagation model

[0134] Step 3 - 3 - 3: Calculate the loss function L. Measure the distribution of the label prediction results output by the model and the actual distribution value

[0135]

[0136] train in the dataset X The number of data samples in the dataset X is I, and the total number of data category labels is M, is the probability that the i-th traffic data is labeled as the m-th class label. If it belongs to the m-th class label, it is 1, otherwise it is 0.

[0137] where denotes the gradient of the j-th parameter. Use the gradient descent method to update the model parameters to θ 1 :

[0138] θ 1 = θ 0 - ηΔθ 0(18)

[0139] Among them, η represents the learning rate.

[0140] Step 3-3-5: Stop iteration. Determine whether the preset number of iterations epochs is reached or the predicted loss value reaches the target value

[0141] If the condition is met, stop the iteration and save the model parameter set θ′={θ′ 1 ,θ′ 2 ,…,θ′ j ,…,θ′ J}; Otherwise, repeat steps 3-3-2 to 3-3-5 until the iteration stops and the LSTM model training is completed.

[0142] The output of the fully connected layer in the last iteration in Indicates the probability that the i-th network traffic data in the training set is predicted to be the m-th class label. The model predicts the label of the i-th network traffic data

[0143] Step 3-4: Construct EWC model;

[0144] The EWC model is used to fine-tune and optimize the parameters previously learned by the LSTM model when training new tasks.

[0145] Step 3-4-1: Initialize the EWC model;

[0146] Initialize EWC model parameters, including: number of iterations epochs EWC , batch size EWC , target loss value

[0147] Step 3-4-2: Calculate the information matrix;

[0148] For the training dataset Calculate the loss function under the LSTM model parameter set θ′, the formula is as follows:

[0149]

[0150] Construct Fisher information matrix to constrain LSTM model parameters;

[0151] Fisher information matrix is ​​expressed as:

[0152]

[0153] The diagonal elements of the Fisher information matrix G jjis the loss function with respect to the LSTM model parameters θ′ j The expected value of the square of the gradient is as follows:

[0154]

[0155] Among them, θ′ j Represents the jth parameter of the parameter set θ′ of the LSTM model.

[0156] Step 3-5: Use the EWC model to modify the LSTM model parameters to form a new LSTM model;

[0157] Step 3-5-1: forward propagation;

[0158] Initialize the LSTM model parameter set for the new task Use Xavier to initialize the parameter set θ * The weights and biases in the weight matrix have a mean of 0 and a variance of The normal distribution of the validation set X val The feature input model of the data vector in , calculates the prediction result through forward propagation, and calculates the loss function L(θ * );

[0159] Step 3-5-2: Calculate the loss function;

[0160] Based on the Fisher information matrix in the EWC model, a regularization term is introduced to correct the LSTM model output in step 3-3; the loss function L of the new model is EWC (θ * ) is calculated as:

[0161]

[0162] Among them, L(θ * ) is the original LSTM model in the new parameter set θ * The loss function under is the parameter set of the new LSTM model, and λ is the regularization coefficient.

[0163] Step 3-5-3: Train the new LSTM model to optimize model parameters;

[0164] In model training, the gradient descent method is used to update the model parameters To minimize the loss function; model parameters θ′ j The update formula is as follows:

[0165]

[0166] Where η is the learning rate.

[0167] Step 3-5-4: Determine whether the training of the new LSTM model is stopped;

[0168] Determine whether the preset number of training iterations ewc_epochs is reached or the loss value reaches the target value If not, repeat steps 3-5 to continue training the new LSTM model; if so, the model training is completed and the final LSTM-EWC model is obtained.

[0169] When the model training is completed, the output of the fully connected layer is in It indicates the probability that the i-th network traffic data in the validation set is predicted to be the m-th class label. The label number of the i-th network traffic data in the prediction validation set is

[0170] Furthermore, in step 4, the model performance evaluation is specifically described as follows:

[0171] Use the test set data X test Evaluate the prediction performance of the LSTM-EWC model for the category labels of network traffic data; the prediction performance evaluation indicators used include accuracy, precision, recall and F1 score. The calculation formulas of each indicator are described as follows:

[0172] Accuracy is the ratio of the number of correctly classified samples to the total number of samples:

[0173]

[0174] Precision measures how many of the samples predicted as positive are actually positive:

[0175]

[0176] Recall measures how many samples that are actually positive are correctly predicted as positive.

[0177]

[0178] The F1 score is the harmonic mean of precision and recall, which takes both precision and recall into consideration.

[0179]

[0180] in:

[0181] TP (True Positives): True positives, the number of samples correctly predicted by the model as positive;

[0182] TN (True Negatives): True negative examples, the number of samples correctly predicted by the model as negative;

[0183] FP (False Positives): False positive examples, the number of samples that the model incorrectly predicts as positive;

[0184] FN (False Negatives): False negative examples, the number of samples that the model incorrectly predicts as negative.

[0185] Based on the above four indicators, the higher the accuracy, the greater the proportion of samples correctly predicted by the model to the total samples, and the better the prediction performance; the higher the precision, the greater the proportion of samples correctly predicted as positive examples by the model to all samples predicted as positive examples, and the better the prediction performance; the higher the recall, the greater the proportion of samples correctly predicted as positive examples by the model to all samples that are actually positive examples; the higher the F1 score, the better the overall prediction performance of the model. It is generally believed that when these four indicators are above 80%, the prediction and classification performance of the LSTM model is good.

[0186] The method uses PyTorch simulation to compare the performance of the LSTM-EWC model of the method with the RNN model, LSTM model, and CNN-LSTM model of the same type. At the same time, the performance of the LSTM-EWC model of the method is compared when training data sets containing different attack types, and the simulation is performed in four dimensions: accuracy, precision, recall, and F1 score. The simulation results are shown in Figure 2. Figure 5 , Figure 6 , Figure 7 shown.

[0187] The simulation parameters are set as follows:

[0188] Model: The input of the LSTM-EWC model is 20, the output is 6, and a 1-layer LSTM neural network is stacked;

[0189] Training data: UNSW-NB15 dataset. Using the 20 most important features extracted by the CART decision tree model, the dataset samples are divided into training set, validation set and test set in a ratio of 7:1:1.

[0190] The first task training parameters: LSTM model training rounds epochs = 50, training batch size batch = 128, learning rate η = 0.001;

[0191] Second task training parameters: LSTM-EWC model training rounds epochs EWC =20, training batch size batch EWC =64, learning rate η = 0.001;

[0192] observe Figure 5 It can be seen that when the training set contains all six types of network traffic labels: in terms of accuracy, precision, recall, and F1 score, the LSTM-EWC model of this method is superior to the RNN model, LSTM model, and CNN-LSTM model in all evaluation indicators.

[0193] observe Figure 6 ,It can be seen that when the LSTM-EWC model of this method detects data with mixed network attacks, the detection efficiency of Reconnaissance,Fuzzers (labeled 0 and 2) attacks is much lower than other attack types, while the detection rate of Normal,Generic (labeled 3 and 4) types of network traffic is the highest.

[0194] observe Figure 7 It can be seen that the LSTM-EWC model of this method can better identify Dos and Generic attacks when detecting network traffic data containing only one type of attack.

[0195] Embodiment 2:

[0196] The computer-readable storage medium of this embodiment stores a computer program thereon, and when the program is executed by a processor, the steps in the network traffic anomaly detection and classification method based on LSTM-EWC of Example 1 are implemented.

[0197] The computer-readable storage medium of this embodiment may be an internal storage unit of the terminal, such as a hard disk or memory of the terminal; the computer-readable storage medium of this embodiment may also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card, a secure digital card, a flash memory card, etc. equipped on the terminal; further, the computer-readable storage medium may also include both an internal storage unit of the terminal and an external storage device.

[0198] The computer-readable storage medium of this embodiment is used to store computer programs and other programs and data required by the terminal. The computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0199] Embodiment 3:

[0200] The computer device of this embodiment includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the LSTM-EWC-based network traffic anomaly detection and classification method of embodiment 1 are implemented.

[0201] In this embodiment, the processor may be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, readily available programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0202] Those skilled in the art will appreciate that the disclosed content of the embodiments may be provided as methods, systems, or computer program products. Therefore, the present solution may adopt the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, the present solution may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0203] The present solution is described with reference to the method according to the embodiment of the present solution and the flowchart and / or block diagram of the computer program product. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions; these computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 one or more processes and / or methods Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 one or more processes and / or methods Figure 1 A function specified in one or more boxes.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 one or more processes and / or methods Figure 1The steps for the functions specified in one or more boxes.

[0206] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0207] The examples described in the present invention are merely descriptions of the preferred implementation modes of the present invention, and are not intended to limit the concept and scope of the present invention. Without departing from the design concept of the present invention, various modifications and improvements made to the technical solutions of the present invention by engineers and technicians in this field should all fall within the protection scope of the present invention.

Claims

1. A network traffic anomaly detection and classification method based on LSTM-EWC, characterized in that: The following steps are involved: S1. Data preprocessing, obtaining the original network traffic dataset X original , the original network traffic dataset X original Contains the characteristics of network traffic and labels the type of network traffic; For the original network traffic dataset X original Perform data cleaning and normalize the characteristic data of network traffic to obtain a new data set X new ; S2. Feature selection: construct a CART decision tree, select the top P features that have a greater impact on network traffic anomaly identification from the network traffic feature list Feature, and construct the target data set X target , and the target dataset X target Divide into training set, validation set and test set; S3. Model building and training: constructing an LSTM-EWC model for network traffic anomaly detection and classification; training the LSTM model with the training set data and saving the parameter set θ′ of the final model; initializing the EWC model and adjusting the parameters of the LSTM-EWC model with the validation set to obtain a new parameter set Update the LSTM model; S4. Model performance evaluation, the test set data is used to evaluate the detection and classification performance of the LSTM-EWC model and calculate the classification evaluation index.

2. The method according to claim 1, characterized in that: S1 specifically includes the following steps: S11. Obtain network traffic data; Select the original network traffic dataset X original =[X1, X2, …, X n , …, X N ] T , where X n =[x n,1 , x n,2 , ..., x n,k , ..., x n,K ] T represents the nth data vector of length K, x n,k represents the kth eigenvalue in the nth data vector, n = 1, 2, ..., N, k = 1, 2, ..., K, the total number of data vectors is N, the number of features of each data vector is K, marking the type of each network traffic, z n Indicates the type label of the nth data; Let the data feature set Feature = {f1, f2, ..., f k , …, f K , f Label }, where f k Indicates the kth feature name of network traffic data, f Label Represents the network traffic label; the category label set of network traffic data is Label = {l1, l2, ..., l m ,…,l M }, where l m Indicates the mth type label of network traffic data, the total number of type labels is M, z n ∈Label; S12. Data cleaning: Use the duplicated function, isnull function, and z-score function in the Pycharm tool to check the original network traffic data set X original Check whether there are duplicate data, missing data, or abnormal data in the data vector. If so, delete the data vector; use label encoding to digitize discrete category features and label data; S13. Data normalization; After cleaning the data set Min-max normalization is performed to scale the data values ​​to the interval [0,1].

3. The method according to claim 2, characterized in that S2 specifically includes the following steps: S21. Initialize CART decision tree; S22. Select the optimal splitting feature and splitting point of the current node; S23. Divide the data set according to the optimal splitting feature and splitting point to generate child nodes; S24. Determine whether the node branch of the CART decision tree stops; S25. Select features and construct a target data set; Feature selection based on feature importance.

4. The method according to claim 3, characterized in that , S21 specifically includes the following steps: let the root node data set of the CART decision tree be the normalized new data set X new ; The maximum depth of the decision tree is H max , the minimum number of samples in the child node data set is Q min , the node is labeled d; Initialize the depth of the CART decision tree to H = 1, the root node number is d = 0, and the root node data set is X0 = X new .

5. The method according to claim 4, characterized in that , S22 specifically includes the following steps: Let the current node, that is, the data set labeled d, be in, No. The type label of the data is Feature set Feature = {f1,f2,…,f K ,f Label }, tag collection Indicates the current node data set The length of the data is K samples.

6. The method according to claim 5, characterized in that , S23 specifically includes the following steps: according to the best split feature f * and split point α * Set the current node's dataset X d Split into two subsets X left and X right , respectively as the data sets of the left and right child nodes of the current node, the left node is labeled d left =2×d+1, the label of the right node is d right =2×d+2; let the depth of the CART decision tree be H=H+1.

7. The method according to claim 6, characterized in that S24 specifically includes the following steps: Check whether the depth H of the CART tree reaches the preset maximum value H max : If so, the node branch stops and the CART decision tree is constructed; If not, further check the two child node data sets X left and X right Is the number of data samples less than the preset minimum value Q? min ; If so, the node branch stops and the CART decision tree is constructed; If not, calculate the two child node data sets X according to formula (4) left and X right The Gini index of is to determine whether it is a positive value; If not, the node branch stops and the CART decision tree construction is completed; If so, use data set X left and X right As the new current node, repeat steps 2-2 to 2-4 and continue node splitting until the CART decision tree is built.

8. The method according to claim 1, characterized in that: S3 specifically includes the following steps: S31. Build LSTM model; S32. Initialize LSTM model parameters; S33. Train LSTM model; S34. Construct EWC model; S35. Use the EWC model to modify the LSTM model parameters to form a new LSTM model.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the LSTM-EWC-based network traffic anomaly detection and classification method as described in any one of claims 1 to 8 are implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the LSTM-EWC-based network traffic anomaly detection and classification method according to any one of claims 1 to 8 are implemented.

Images