DoH encryption malicious traffic detection method based on deep learning model

Abstract

The invention discloses a DoH encryption malicious traffic detection method based on a deep learning model, and relates to the technical field of network security, and the method comprises the steps: obtaining domain name system DoH traffic based on HTTPS; and inputting the DoH traffic into a pre-constructed traffic detection model to obtain a malicious traffic detection result, the traffic detection model being constructed based on a binary cross entropy and a focus loss function, and the malicious traffic detection method and apparatus can improve the detection precision of the malicious traffic.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a DoH encrypted malicious traffic detection method based on a deep learning model. Background Art

[0002] With the rapid development of the Internet, network security threats are increasing. To enhance network security, DoH (DNS over HTTPS, Domain Name System based on HTTPS) technology has gradually become a common protocol in Internet communications, which encrypts and transmits DNS requests through HTTPS, improving communication privacy. However, malicious attackers also use DoH encryption technology to hide their attack behaviors, making traditional feature-based malicious traffic detection methods ineffective or inefficient.

[0003] In the face of this challenge, there are currently some machine learning-based solutions in the field of network security. However, due to the encryption of DoH traffic and the concealment of malicious behavior, the existing machine learning models have low accuracy in detecting malicious traffic.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a DoH encrypted malicious traffic detection method based on a deep learning model, aiming to solve the current technical problem of low accuracy in malicious traffic detection.

[0006] To achieve the above objectives, this application proposes a DoH encrypted malicious traffic detection method based on a deep learning model, the method comprising:

[0007] Get DNS DoH traffic over HTTPS;

[0008] The DoH traffic is input into a pre-built traffic detection model to obtain a malicious traffic detection result, where the traffic detection model is built based on binary cross entropy and focal loss function.

[0009] In one embodiment, before the step of inputting the DoH traffic into a pre-built traffic detection model to obtain a malicious traffic detection result, the step includes:

[0010] The flow detection model is constructed based on the residual network and the Kolmogorov-Arnold KAN network.

[0011] In one embodiment, the step of constructing the flow detection model based on the residual network and the Kolmogorov-Arnold KAN network includes:

[0012] Collect sample data;

[0013] Preprocessing the sample data to obtain sample features;

[0014] Dividing the sample features into a training set, a validation set, and a test set;

[0015] Constructing a first detection model based on the residual network and the KAN network;

[0016] The first detection model is trained based on the training set, and corresponding weights are assigned to malicious traffic and / or difficult-to-classify traffic in the training set by using the binary cross entropy and the focal loss function to obtain a second detection model;

[0017] Adjusting the hyperparameters in the second detection model based on the validation set to obtain a third detection model;

[0018] Performing performance evaluation and performance calculation on the third detection model based on the test set to obtain a performance index;

[0019] The flow detection model is determined based on the performance indicator.

[0020] In one embodiment, the step of obtaining the HTTPS-based domain name system DoH traffic includes:

[0021] Preprocessing the DoH traffic to obtain statistical characteristics of the DoH traffic;

[0022] The step of inputting the DoH traffic into a pre-built traffic detection model to obtain a malicious traffic detection result comprises:

[0023] The statistical characteristics of the DoH traffic are input into the pre-built traffic detection model to obtain the malicious traffic detection result.

[0024] In one embodiment, the step of inputting the statistical characteristics of the DoH traffic into the pre-built traffic detection model to obtain the malicious traffic detection result includes:

[0025] Extracting features from the statistical features through a plurality of residual blocks in the flow detection model to obtain features of the spatial dimension;

[0026] Performing feature aggregation on the features of the spatial dimension to obtain a global feature vector;

[0027] Classifying the global feature vector through the fully connected layer in the traffic detection model to obtain a classification result;

[0028] The malicious traffic detection result is obtained based on the classification result.

[0029] In one embodiment, the step of extracting features from the statistical features through a plurality of residual blocks in the traffic detection model to obtain features of the spatial dimension includes:

[0030] Performing convolution operations, batch normalization operations, attention adjustment operations, and rectified linear unit (ReLU) activation function activation operations on the statistical features through a plurality of Kolmogorov-Arnold (KAN) layers to obtain a feature map;

[0031] Adding the statistical features to the feature map through residual connection to obtain an output result after residual connection;

[0032] The output result after the residual connection is batch normalized and activated using the ReLU activation function to obtain the features of the spatial dimension.

[0033] In one embodiment, the step of performing an attention adjustment operation on the statistical feature traversal through the plurality of Kolmogorov-Arnold KAN layers comprises:

[0034] The task-related features in the statistical features are enhanced through the multiple KAN layers, and irrelevant features in the statistical features are suppressed.

[0035] In addition, to achieve the above objectives, the present application also proposes a DoH encrypted malicious traffic detection device based on a deep learning model, and the traffic detection device includes:

[0036] Traffic acquisition module, used to obtain DoH traffic based on HTTPS;

[0037] The traffic detection module is used to input the DoH traffic into a pre-built traffic detection model to obtain malicious traffic detection results, and the traffic detection model is built based on binary cross entropy and focal loss function.

[0038] In addition, to achieve the above-mentioned objectives, the present application also proposes a DoH encrypted malicious traffic detection device based on a deep learning model, the device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the DoH encrypted malicious traffic detection method based on a deep learning model as described above.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the DoH encrypted malicious traffic detection method based on the deep learning model as described above are implemented.

[0040] One or more technical solutions proposed in this application have at least the following technical effects:

[0041] This application classifies traffic through a traffic detection model constructed based on binary cross entropy and focal loss function. Binary cross entropy is a loss function suitable for binary classification tasks. In the traffic detection model, it can measure the difference between the model prediction result and the true label, and improve the accuracy of malicious traffic detection; the focal loss function is an improved loss function proposed for the problem of class imbalance. In malicious traffic detection, there is often a situation where normal traffic far exceeds malicious traffic, which will cause the model to pay more attention to normal traffic during training and ignore a small number of important malicious traffic. The focal loss function improves the detection rate of malicious traffic by reducing the weight of easy-to-classify samples, increasing the weight of difficult-to-classify samples, and balancing the weights between different categories. It can more accurately detect and classify malicious traffic while ensuring the overall performance of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1 A flowchart diagram of the first embodiment of the DoH encrypted malicious traffic detection method based on a deep learning model of the present application is provided;

[0045] Figure 2 A simple flow chart for building a traffic detection model for the DoH encrypted malicious traffic detection method based on a deep learning model in this application;

[0046] Figure 3 This is a schematic diagram of the module structure of the flow detection device according to an embodiment of the present application;

[0047] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the DoH encrypted malicious traffic detection method based on the deep learning model in the embodiment of the present application.

[0048] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0050] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0051] Technical terms involved in the embodiments of the present invention:

[0052] HTTPS: HTTPS (HyperText Transfer Protocol Secure) is a secure network transmission protocol that uses SSL / TLS encryption technology to ensure the security and integrity of data during transmission. The HTTPS protocol is widely used in web browsing, data transmission and other scenarios to prevent data from being stolen or tampered with.

[0053] DoH: DoH (DNS over HTTPS) is a technology that performs domain name resolution through the HTTPS protocol. Compared with traditional DNS resolution, DoH can encrypt the communication between users and DNS servers, thereby protecting user privacy and security. DoH achieves encryption and privacy protection of domain name resolution by encapsulating DNS queries in HTTPS requests, sending them to DNS resolution servers, and then receiving encrypted responses.

[0054] Residual Network: Residual Network (ResNet) is a deep convolutional neural network that solves the gradient disappearance and gradient explosion problems in deep neural networks by introducing residual blocks.

[0055] Kolmogorov-Arnold (KAN) network: The Kolmogorov-Arnold (KAN) network is a neural network based on the high-dimensional function approximation theory, which uses the decomposition and approximation properties of high-dimensional functions to build a model.

[0056] The main solution of the embodiment of the present application is: to obtain DoH traffic of the domain name system based on HTTPS; to input the DoH traffic into a pre-built traffic detection model to obtain malicious traffic detection results, and the traffic detection model is built based on binary cross entropy and focal loss function.

[0057] In this embodiment, for the convenience of description, the flow detection system is used as the execution subject for explanation below.

[0058] Existing machine learning models have limitations in detection accuracy and generalization ability. In addition, since normal traffic in network traffic far outweighs malicious traffic, the sample imbalance problem is also a key bottleneck.

[0059] The present application provides a solution. The present application classifies traffic through a traffic detection model constructed based on binary cross entropy and focal loss function. Binary cross entropy is a loss function suitable for binary classification tasks. In the traffic detection model, it can measure the difference between the model prediction result and the true label, thereby improving the accuracy of malicious traffic detection. The focal loss function is an improved loss function proposed for the problem of class imbalance. In malicious traffic detection, there is often a situation where normal traffic far exceeds malicious traffic, which will cause the model to pay more attention to normal traffic during training and ignore a small number of important malicious traffic. The focal loss function improves the detection rate of malicious traffic by reducing the weight of easy-to-classify samples, increasing the weight of difficult-to-classify samples, and balancing the weights between different categories. It can more accurately detect and classify malicious traffic while ensuring the overall performance of the model.

[0060] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a flow detection device, etc. that can realize the above functions, or an electronic system, a flow detection system, etc. that can realize the above functions. The flow detection system is taken as an example to illustrate this embodiment and the following embodiments.

[0061] Based on this, the embodiment of the present application provides a DoH encrypted malicious traffic detection method based on a deep learning model. Figure 1 , Figure 1 A flowchart diagram is provided for Example 1 of the DoH encrypted malicious traffic detection method based on a deep learning model of the present application.

[0062] In this embodiment, the DoH encrypted malicious traffic detection method based on the deep learning model includes steps S20 and S40:

[0063] Step S20, obtaining HTTPS-based domain name system DoH traffic;

[0064] It should be noted that in this step, the system or tool will capture or record DoH traffic transmitted based on the HTTPS protocol. This usually involves monitoring and analyzing network traffic to identify and extract DoH-related data packets. Methods for obtaining DoH traffic may include but are not limited to using network packet capture tools, traffic analysis tools, or specialized network security equipment.

[0065] Step S40, inputting the DoH traffic into a pre-constructed traffic detection model to obtain malicious traffic detection results, wherein the traffic detection model is constructed based on binary cross entropy and focal loss function.

[0066] It should be noted that the traffic detection model is a machine learning or deep learning model used to classify network traffic. In the field of network security, traffic detection models are usually used to identify and distinguish different types of network traffic, such as normal traffic, malicious traffic, DDoS attack traffic, etc.

[0067] Among them, binary cross entropy is a loss function suitable for binary classification tasks. In the traffic detection model, it can measure the difference between the model prediction results and the true label, and improve the accuracy of malicious traffic detection; the focus loss function is an improved loss function proposed for the problem of class imbalance. In malicious traffic detection, there is often a situation where normal traffic is far more than malicious traffic, which will cause the model to pay more attention to normal traffic during training and ignore the minority but important malicious traffic. The focus loss function improves the detection rate of malicious traffic by reducing the weight of easy-to-classify samples, increasing the weight of difficult-to-classify samples, and balancing the weights between different categories.

[0068] This embodiment provides a DoH encrypted malicious traffic detection method based on a deep learning model. The application classifies traffic through a traffic detection model constructed based on binary cross entropy and focal loss function. Binary cross entropy is a loss function suitable for binary classification tasks. In the traffic detection model, it can measure the difference between the model prediction result and the true label, thereby improving the accuracy of malicious traffic detection. The focal loss function is an improved loss function proposed for the problem of class imbalance. In malicious traffic detection, there is often a situation where normal traffic far exceeds malicious traffic, which will cause the model to pay more attention to normal traffic during training and ignore a small number of important malicious traffic. The focal loss function improves the detection rate of malicious traffic by reducing the weight of easy-to-classify samples, increasing the weight of difficult-to-classify samples, and balancing the weights between different categories. It can more accurately detect and classify malicious traffic while ensuring the overall performance of the model.

[0069] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be repeated hereafter. On this basis, in step S20, before obtaining the DoH traffic of the domain name system based on HTTPS, the DoH encrypted malicious traffic detection method based on the deep learning model also includes step S10:

[0070] Step S10, constructing the flow detection model based on the residual network and the Kolmogorov-Arnold KAN network.

[0071] Among them, the traffic detection model is built based on the residual network (ResNet) and the Kolmogorov-Arnold (KAN) network, which combines two different types of neural network structures to achieve efficient and accurate classification of network traffic.

[0072] Among them, in traffic detection, the KAN network can be used to further process the features extracted by ResNet, or combined with ResNet to jointly extract and classify traffic features.

[0073] This embodiment combines the advantages of ResNet and KAN networks to more effectively extract and classify network traffic features, thereby improving classification accuracy. In addition, this embodiment introduces different types of neural network structures so that the model can learn more diverse feature representations, thereby enhancing the generalization ability of the model.

[0074] Based on the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the second embodiment can be referred to the above introduction, and will not be repeated later. On this basis, step S10, based on the residual network and the Kolmogorov-Arnold KAN network, constructs the flow detection model and also includes steps S11 to S18:

[0075] Step S11, collecting sample data;

[0076] As an implementation method, network traffic data may be collected and labeled to distinguish normal traffic from malicious traffic, or different types of network attacks, and the distinguished data may be used as sample data.

[0077] Step S12, preprocessing the sample data to obtain sample features;

[0078] As an implementation method, preprocessing the sample data can clean the data, remove irrelevant information, extract statistical features or time-series-based features in the traffic, and obtain sample features.

[0079] Step S13, dividing the sample features into a training set, a validation set and a test set;

[0080] Among them, dividing sample features into training sets, validation sets, and test sets is a common practice in machine learning and data science, which will not be elaborated here.

[0081] Step S14, constructing a first detection model based on the residual network and the KAN network;

[0082] Among them, the model can be initialized according to the network structure of the KAN layer and the residual network, and the number of input channels, KAN layer parameters, number of residual block layers, convolution kernel size, etc. can be defined. The improved loss function and optimizer can be selected, and the hyperparameters can be set.

[0083] Step S15, training the first detection model based on the training set, assigning corresponding weights to malicious traffic and / or difficult-to-classify traffic in the training set through the binary cross entropy and the focal loss function, and obtaining a second detection model;

[0084] It should be noted that the traditional cross entropy loss function does not work well when the sample categories are unbalanced, especially in malicious traffic detection, where the distribution of positive and negative samples is extremely unbalanced. In order to solve this problem, the present invention proposes a loss function (focus loss function) based on BCE (Binary CrossEntropy) and Focal Loss, which gives higher weights to malicious traffic (minority class samples) and difficult-to-classify samples, thereby ensuring that the model can focus on malicious traffic and difficult-to-classify samples during training, thereby improving the accuracy of malicious traffic detection. The specific improvements to the weights are as follows:

[0085] [w(e)=β·(1+tanh(δ·e))]

[0086] Where β is a positive number used to control the size of the overall weight. If it is a minority sample, the β value is larger and vice versa. e is the absolute error between the predicted value and the actual value, and δ is an adjustment factor used to control the influence of the error e on the weight. The characteristic of this function is that when the error e increases, the weight will increase smoothly through the action of the hyperbolic tangent function.

[0087] This design ensures that difficult-to-classify samples (i.e., samples with larger errors) receive larger weights, while easy-to-classify samples (i.e., samples with smaller errors) receive relatively smaller weights. At the same time, due to the smoothness of the hyperbolic tangent function, this weighting factor function can avoid drastic changes in weights near the threshold, thereby helping to improve the generalization of the model.

[0088] In this step, each training cycle loads a batch of network traffic data from the training set and generates the input format of the model through preprocessing. The input data is fed into the model, and the output of the network is calculated after passing through the KAN layer, residual block layer, global average pooling and fully connected layer.

[0089] Step S16, adjusting the hyperparameters in the second detection model based on the verification set to obtain a third detection model;

[0090] The loss value is calculated by outputting and comparing it with the true label to measure the gap between the predicted result and the true result. Based on the loss value, back propagation is performed to calculate the gradient of the model parameters. The optimizer is used to update the model parameters based on the gradient.

[0091] Step S17, performing performance evaluation and performance calculation on the third detection model based on the test set to obtain a performance index;

[0092] Step S18: determining the flow detection model based on the performance indicator.

[0093] After training is completed, the model is finally evaluated using the test set, and the performance indicators of the test set are calculated to determine the performance of the model on unseen data.

[0094] This embodiment combines ResNet and KAN networks to build a traffic detection model, which can adapt to complex network environments, including different traffic types, different network topologies, and different attack methods. In addition, this embodiment uses binary cross entropy and focal loss functions as loss functions, and gives higher weights to malicious traffic (minority class samples) and difficult-to-classify samples, ensuring that the model can focus on malicious traffic and difficult-to-classify samples during training, thereby improving the accuracy of malicious traffic detection.

[0095] Based on the first embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above introduction, and will not be repeated later. On this basis, in step S20, after obtaining the DoH traffic of the domain name system based on HTTPS, the DoH encrypted malicious traffic detection method based on the deep learning model also includes step S30:

[0096] Step S30, preprocessing the DoH traffic to obtain statistical characteristics of the DoH traffic;

[0097] Among them, by preprocessing the DoH traffic, the data packet size, time interval, traffic direction, etc. can be obtained as statistical characteristics of the DoH traffic.

[0098] The step S40, inputting the DoH traffic into a pre-built traffic detection model, and obtaining a malicious traffic detection result includes step S41:

[0099] Step S41, inputting the statistical characteristics of the DoH traffic into the pre-built traffic detection model to obtain the malicious traffic detection result.

[0100] The statistical features of DoH traffic are input into the traffic detection model. These statistical features are used as the input of the model, and after calculation and processing by the model, the corresponding malicious traffic detection results will be output.

[0101] This embodiment preprocesses DoH traffic and extracts statistical features to remove redundant and noisy information in the original data and retain key information useful for classification, which helps to improve the accuracy and robustness of the traffic detection model.

[0102] Based on the fourth embodiment of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the fourth embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S41, inputting the statistical characteristics of the DoH traffic into the pre-built traffic detection model, and obtaining the malicious traffic detection result also includes steps S411 to S413:

[0103] Step S411, extracting features from the statistical features through a plurality of residual blocks in the flow detection model to obtain features of a spatial dimension;

[0104] Among them, the residual block is a commonly used structure in deep learning. It helps solve the gradient vanishing and gradient exploding problems in deep network training by introducing skip connections. These residual blocks perform multi-level convolution operations and nonlinear transformations on the input statistical features to extract spatial dimension features. These features reflect the relationship and pattern of statistical features in space (i.e. between different features).

[0105] In this embodiment, the statistical features can be extracted through the four residual blocks in the traffic detection model to obtain features of the spatial dimension.

[0106] Step S412, performing feature aggregation on the features of the spatial dimension to obtain a global feature vector;

[0107] Among them, after the data is processed by several residual blocks, the model aggregates the features of the spatial dimension into a global feature vector of a fixed size for classification.

[0108] Step S413, classifying the global feature vector through the fully connected layer in the traffic detection model to obtain a classification result.

[0109] Among them, after feature aggregation, the model uses a fully connected layer to finally classify the data.

[0110] Among them, the fully connected layer is a linear transformation layer, which performs weighted summation on the global feature vector and outputs the classification result through an activation function (such as softmax). The classification result is usually a probability distribution, indicating the probability that the input traffic belongs to each category.

[0111] Step S414, obtaining the malicious traffic detection result based on the classification result.

[0112] Among them, the classification results can be converted into specific malicious traffic detection results. This usually involves the following three steps:

[0113] (1) Probability threshold setting: In order to determine whether traffic is malicious, one or more probability thresholds need to be set. For example, a threshold can be set, and when the probability of traffic being classified as malicious traffic exceeds this threshold, the traffic is considered malicious.

[0114] (2) Classification result judgment: The classification result is judged according to the set threshold. If the probability of traffic being classified as malicious traffic exceeds the set threshold, the traffic is marked as malicious traffic; otherwise, it is marked as normal traffic or other categories.

[0115] (3) Output results: Finally, the judgment result is output as the malicious traffic detection result. This result can be a simple label (such as "malicious" or "normal"), or it can be a report containing more information (such as traffic type, malicious degree, possible attack type, etc.).

[0116] By introducing the residual block, the model in this embodiment can more deeply extract the spatial dimension information in the statistical features, thereby capturing more complex traffic patterns. In addition, the feature aggregation step integrates the features of the spatial dimension into a global feature vector, which enables the model to better handle input data of different scales and shapes, improving the generalization ability of the model.

[0117] Based on the fifth embodiment of the present application, in the sixth embodiment of the present application, the same or similar contents as those in the fifth embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S411, extracting the statistical features through several residual blocks in the flow detection model, and obtaining the features of the spatial dimension also includes steps S4111 to S4113:

[0118] Step S4111, performing convolution operation, batch normalization operation, attention adjustment operation and rectified linear unit (ReLU) activation function activation operation on the statistical features through a plurality of Kolmogorov-Arnold KAN layers to obtain a feature map;

[0119] Among them, the traffic detection model can have several KAN layers.

[0120] In this embodiment, as an implementation method, the traffic detection model has two KAN layers.

[0121] First, the statistical features are convolved, batch normalized, and adjusted for attention through the first KAN layer, and then activated using the ReLU activation function. The output feature map is then passed through the second KAN layer for the same operation, that is, convolution, batch normalization, and attention adjustment are performed again in the second KAN layer, and then activated using the ReLU activation function.

[0122] Step S4112, adding the statistical features to the feature map through residual connection to obtain an output result after residual connection;

[0123] Among them, the statistical features are directly added to the feature map after two KAN processes through residual connections (skip connections) to achieve feature retention, retain the global information of the input data, and prevent the feature information from being lost when the number of layers increases.

[0124] Step S4113, performing batch normalization processing on the output result after the residual connection and activating it using the ReLU activation function to obtain the features of the spatial dimension.

[0125] Among them, the output after residual connection is batch normalized and activated by ReLU to generate features of spatial dimension, which is the output of the first stage.

[0126] In this embodiment, the statistical features can be extracted through the four residual blocks in the traffic detection model to obtain features of the spatial dimension.

[0127] That is, the four residual blocks in the traffic detection model execute steps S4111 to S4113 for the statistical features. As the network deepens, the number of input and output channels of each layer increases, the size of the output feature map of each residual block gradually decreases, the expressive power of the features continues to increase, and features of different scales and complexities are extracted.

[0128] This embodiment can continuously enhance the expressiveness of features and extract features of different scales and complexities through residual connections and deep feature learning.

[0129] Based on the sixth embodiment of the present application, in the seventh embodiment of the present application, the same or similar contents as those in the sixth embodiment can be referred to the above description, and will not be described in detail later. On this basis, the step S4111, performing the attention adjustment operation on the statistical feature traversal through the several Kolmogorov-Arnold KAN layers, also includes step S41111:

[0130] Step S41111: enhancing the task-related features in the statistical features through the plurality of KAN layers, and suppressing irrelevant features in the statistical features.

[0131] Among them, the KAN layer used in this deep learning model first extracts features through convolution operations, and then adaptively focuses on important areas in the input data through the attention mechanism. Finally, the feature map is adjusted by the attention mechanism to enhance important features related to the task while suppressing irrelevant features.

[0132] Among them, the important features related to the task are malicious traffic and difficult-to-classify samples.

[0133] This embodiment enhances the task-related features (malicious traffic and difficult-to-classify samples) in the statistical features through the several KAN layers, and suppresses irrelevant features in the statistical features, ensuring that the model can focus on malicious traffic and difficult-to-classify samples during training, thereby improving the accuracy of malicious traffic detection.

[0134] For example, to help understand the above embodiments, please refer to Figure 2 , Figure 2 A simple flow chart of building a traffic detection model for the DoH encrypted malicious traffic detection method based on a deep learning model in this application. Specifically, Figure 2 The following steps are involved:

[0135] S1: Collect and annotate network traffic data to distinguish normal traffic from malicious traffic or different types of network attacks. Clean the data to remove irrelevant information and extract statistical features or time-series-based features from the traffic. Divide the preprocessed data set into training, validation and test sets.

[0136] S2: Initialize the model according to the network structure, use KAN layer and residual network, define the number of input channels, KAN layer parameters, number of residual block layers, convolution kernel size, etc. Select the improved loss function and optimizer, and set the hyperparameters.

[0137] S3: Each training cycle loads a batch of network traffic data from the training set and generates the input format of the model through preprocessing. The input data is fed into the model, and the output of the network is calculated through the KAN layer, residual block layer, global average pooling, and fully connected layer. The loss value is calculated by comparing the output with the true label to measure the gap between the predicted result and the true result. According to the loss value, back propagation is performed to calculate the gradient of the model parameters. The optimizer is used to update the parameters of the model according to the gradient.

[0138] S4: After training is completed, use the test set to perform a final evaluation of the model, calculate the performance indicators of the test set, and judge the performance of the model on unseen data.

[0139] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the DoH encrypted malicious traffic detection method based on the deep learning model of the present application. More forms of simple transformations based on this technical concept are all within the scope of protection of the present application.

[0140] This application also provides a DoH encrypted malicious traffic detection device based on a deep learning model, please refer to Figure 3 , the flow detection device comprises:

[0141] Traffic acquisition module 10, used to acquire DoH traffic of the domain name system based on HTTPS;

[0142] The traffic detection module 20 is used to input the DoH traffic into a pre-built traffic detection model to obtain malicious traffic detection results. The traffic detection model is built based on binary cross entropy and focal loss function.

[0143] The flow detection device provided by the present application adopts the DoH encrypted malicious flow detection method based on deep learning model in the above embodiment, which can solve the technical problem of low accuracy of malicious flow detection. Compared with the prior art, the beneficial effects of the flow detection device provided by the present application are the same as the beneficial effects of the DoH encrypted malicious flow detection method based on deep learning model provided in the above embodiment, and the other technical features in the flow detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0144] The present application provides a DoH encrypted malicious traffic detection device based on a deep learning model, and the traffic detection device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the DoH encrypted malicious traffic detection method based on the deep learning model in the above-mentioned embodiment one.

[0145] Reference below Figure 4 , which shows a schematic diagram of the structure of a flow detection device suitable for implementing the embodiment of the present application. The flow detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4The flow detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0146] like Figure 4 As shown, the flow detection device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the flow detection device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the flow detection device to communicate with other devices wirelessly or wired to exchange data. Although the flow detection device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided alternatively.

[0147] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0148] The traffic detection device provided by the present application adopts the DoH encrypted malicious traffic detection method based on deep learning model in the above embodiment, which can solve the technical problem of low accuracy in malicious traffic detection. Compared with the prior art, the beneficial effects of the traffic detection device provided by the present application are the same as the beneficial effects of the DoH encrypted malicious traffic detection method based on deep learning model provided in the above embodiment, and the other technical features in the traffic detection device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0149] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0150] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0151] The present application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, and the computer-readable program instructions are used to execute the DoH encrypted malicious traffic detection method based on the deep learning model in the above-mentioned embodiment.

[0152] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0153] The computer-readable storage medium may be included in the flow detection device; or may exist independently without being assembled into the flow detection device.

[0154] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the traffic detection device, the traffic detection device: obtains DoH traffic of the domain name system based on HTTPS; inputs the DoH traffic into a pre-built traffic detection model to obtain malicious traffic detection results, and the traffic detection model is constructed based on binary cross entropy and focal loss function.

[0155] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0156] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0157] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0158] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned DoH encrypted malicious traffic detection method based on deep learning models, which can solve the technical problem of low accuracy in malicious traffic detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the DoH encrypted malicious traffic detection method based on deep learning models provided in the above-mentioned embodiments, and will not be repeated here.

[0159] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A DoH encrypted malicious traffic detection method based on a deep learning model, characterized in that: The method comprises: Get DNS DoH traffic over HTTPS; The DoH traffic is input into a pre-built traffic detection model to obtain a malicious traffic detection result, where the traffic detection model is built based on binary cross entropy and focal loss function.

2. The method according to claim 1, characterized in that The step of inputting the DoH traffic into a pre-built traffic detection model to obtain a malicious traffic detection result includes: The flow detection model is constructed based on the residual network and the Kolmogorov-Arnold KAN network.

3. The method according to claim 2, characterized in that The steps of constructing the flow detection model based on the residual network and the Kolmogorov-Arnold KAN network include: Collect sample data; Preprocessing the sample data to obtain sample features; Dividing the sample features into a training set, a validation set, and a test set; Constructing a first detection model based on the residual network and the KAN network; The first detection model is trained based on the training set, and corresponding weights are assigned to malicious traffic and / or difficult-to-classify traffic in the training set by using the binary cross entropy and the focal loss function to obtain a second detection model; Adjusting the hyperparameters in the second detection model based on the validation set to obtain a third detection model; Performing performance evaluation and performance calculation on the third detection model based on the test set to obtain a performance index; The flow detection model is determined based on the performance indicator.

4. The method according to claim 1, characterized in that The step of obtaining HTTPS-based Domain Name System DoH traffic then includes: Preprocessing the DoH traffic to obtain statistical characteristics of the DoH traffic; The step of inputting the DoH traffic into a pre-built traffic detection model to obtain a malicious traffic detection result comprises: The statistical characteristics of the DoH traffic are input into the pre-built traffic detection model to obtain the malicious traffic detection result.

5. The method according to claim 4, characterized in that The step of inputting the statistical features of the DoH traffic into the pre-built traffic detection model to obtain the malicious traffic detection result includes: Extracting the statistical features through a plurality of residual blocks in the flow detection model to obtain features of the spatial dimension; Performing feature aggregation on the features of the spatial dimension to obtain a global feature vector; Classifying the global feature vector through the fully connected layer in the traffic detection model to obtain a classification result; The malicious traffic detection result is obtained based on the classification result.

6. The method according to claim 5, characterized in that The step of extracting features from the statistical features through a plurality of residual blocks in the flow detection model to obtain features of the spatial dimension comprises: Performing convolution operations, batch normalization operations, attention adjustment operations, and rectified linear unit (ReLU) activation function activation operations on the statistical features through a plurality of Kolmogorov-Arnold (KAN) layers to obtain a feature map; Adding the statistical features to the feature map through residual connection to obtain an output result after residual connection; The output result after the residual connection is batch normalized and activated using the ReLU activation function to obtain the features of the spatial dimension.

7. The method according to claim 6, characterized in that The step of performing attention adjustment operation on the statistical feature traversal through the plurality of Kolmogorov-Arnold KAN layers comprises: The task-related features in the statistical features are enhanced through the multiple KAN layers, and irrelevant features in the statistical features are suppressed.

8. A DoH encrypted malicious traffic detection device based on a deep learning model, characterized in that: The device comprises: Traffic acquisition module, used to obtain DoH traffic based on HTTPS; The traffic detection module is used to input the DoH traffic into a pre-built traffic detection model to obtain malicious traffic detection results, and the traffic detection model is built based on binary cross entropy and focal loss function.

9. A DoH encrypted malicious traffic detection device based on a deep learning model, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the DoH encrypted malicious traffic detection method based on a deep learning model as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the DoH encrypted malicious traffic detection method based on the deep learning model as described in any one of claims 1 to 7 are implemented.

Images