A traffic classification method and system based on smooth noise data enhancement

Abstract

The present invention discloses a traffic classification method and system based on smooth noise data enhancement. The method comprises the following steps: a noise generation module generates unified normalized noise and converts the normalized noise into characteristic noise; a noise optimization module optimizes the noise shape through a gradient-based algorithm and optimizes the noise scale through an improved Bayesian optimizer; a data enhancement module generates optimized smooth noise based on the optimized noise shape and noise scale, and adds the optimized smooth noise to benign and malicious samples, respectively, to obtain enhanced new samples; an integrated learning module uses the enhanced samples as pseudo-malicious samples to train a traffic classifier, collects the results of traffic classifiers trained under multiple sets of noise scales, and combines the classification results using an improved Boosting algorithm to obtain the final classification result. The method effectively optimizes the classification boundary of the traffic classifier, improves the recall rate of the traffic classifier for unknown types of malicious traffic, and enhances the generalization of the classification results.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a traffic classification method and system based on smooth noise data enhancement. Background Art

[0002] Network traffic classification is a crucial task in cyberspace security and network management. Identifying malicious traffic from benign traffic for network anomaly detection is a crucial aspect of cyberspace security. In recent years, researchers have largely opted to use machine learning and deep learning methods to identify malicious traffic. They extract multiple features from traffic and use these traffic as sample nodes. Based on these features, they then use machine learning or deep learning models to detect the maliciousness of each node.

[0003] Current traffic classification methods are able to meet traffic classification needs under various conditions. However, most of these methods are limited to traffic types that appear in the training set. They fail to learn the data patterns underlying traffic samples and cannot output appropriate classifications for data outside the training set. Compared to classification performance on the test set, traffic classifiers cannot maintain high accuracy when faced with unknown types of malicious traffic. Summary of the Invention

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides a traffic classification method based on smooth noise data enhancement to improve the generalization of traffic classification.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A first aspect provides a traffic classification method based on smooth noise data enhancement, comprising:

[0007] Generate uniform normalized noise, and use the cumulative distribution function of Gaussian function, ISRU function and inverse tangent function to process the normalized noise and convert it into characteristic noise;

[0008] The noise shape is optimized using a gradient-based algorithm that uses a loss function based on the softmax probability of the traffic classifier. The noise scale is optimized using a modified Bayesian optimizer. Before optimization, the sample is divided into several parts. In each part, independent optimization processes are performed on benign samples and each type of malicious sample.

[0009] generating optimized smooth noise according to the optimized noise shape and noise scale, and adding the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0010] The enhanced benign samples and malicious samples are uniformly marked as pseudo-malicious samples and added to the original samples as a training set to train the traffic classifier. The classification results of the traffic classifier trained under multiple groups of enhanced samples are collected, and the weights are calculated using the improved Boosting algorithm. The classification results are weighted averaged to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0011] In one embodiment, the formula used to convert normalized noise into characteristic noise is:

[0012]

[0013] p i =F n,i (ε n,i ),i=1,2…d

[0014] Where Ψ represents the noise conversion function, ε n is the normalized noise, ε n Contains d dimensions, and ε n Obey the distribution Dn,ε n,i is the i-th dimension of the noise, Ψ i (ε n,i ) represents ε n,i The corresponding noise characteristics, F n,i is the cumulative distribution function of Dn, p i is the cumulative distribution function value of the i-th dimension, t is the noise scale factor, and is the target parameter for noise scale optimization. and is the noise shape factor, which is the target parameter for noise shape optimization. Shared by noise in all dimensions, The noise of a single dimension is unique, k is the subscript of the noise shape factor, and represents three special distribution functions: Gaussian function, ISRU function and inverse tangent function. is the cumulative distribution function of the kth distribution function.

[0015] In one embodiment, the noise shape is optimized using a gradient-based algorithm. The original samples are used as the training set, and the noisy samples are used as the test set. The loss function used in the optimization process is as follows:

[0016]

[0017] in, is the loss function of the noise shape optimization process, and are the loss functions for misclassified samples and correctly classified samples, ε n is the normalized noise that follows the distribution Dn, x (ns) is the nsth original sample in the training set, the training set size is N, Θ is the noise shape factor set, Λ(Θ) is the regularization term, and λ is the hyperparameter that controls the regularization strength. is the indicator function, Ψ(ε n ) is the characteristic noise, f is the classification process of the traffic classifier, s is the scoring function of the traffic classifier, is the category space of traffic samples, and is the loss function for the misclassified samples and correctly classified samples of a certain category, c is a category in the category space, f is the classification result of the classifier on category c, s c is the scoring function value of category c.

[0018] In one embodiment, when optimizing the noise scale using the improved Bayesian optimizer, the loss function used includes:

[0019] T={T 1 ,……,T ks}

[0020] T ks =x tr,ks ∪x te,ks

[0021]

[0022] Among them, T is the original sample set, T ks is the ksth sample, x tr,ks and x te,ks From T ks The training samples and test samples are divided into and are malicious samples and benign samples in the training samples, respectively. is a malicious sample of the ic category in the training sample; is the loss function of malicious samples of category ic, is the loss function of benign samples; Tr is the training set, Te is the test set, and Accuracy is the accuracy of the traffic classifier on the test set Te after training on the training set Tr; A training set constructed for malicious samples of category ic, which contains original benign samples and the original malicious sample of category ic Also includes enhanced samples and A training set constructed for benign traffic, which contains original benign samples and enhanced samples In the corresponding training set, it is marked as a malicious sample; Te ks The test set contains the original benign samples and all categories of original malicious samples Enhanced sample of malicious traffic From the original sample Add noise to get; enhance the sample A set of enhanced samples after adding noise to each type of benign sample.

[0023] In one embodiment, smooth noise is added to benign samples and malicious samples respectively to obtain enhanced samples, including:

[0024] Split the training set into multiple training subsets, where each training subset includes benign samples and malicious samples, and each subset is used to optimize a set of noise scales;

[0025] Generate a corresponding batch of enhanced samples for each set of noise scales.

[0026] In one embodiment, the enhanced sample is obtained by:

[0027]

[0028] Among them, Optimizer is the noise scale optimizer, ks is the number of samples, ic is a certain category, is the loss function of benign samples, tb ks is the optimized benign sample noise scale, is the loss function of malicious samples, is the optimized malicious sample noise scale sequence, Large returns the sequence The pth optimal factor in , is a factor group consisting of two noise factors, is the conversion function of normalized noise according to the noise factor group, x ks For the original sample, The enhanced sample.

[0029] In one embodiment, the weights are calculated using an improved Boosting algorithm, including:

[0030] Select all benign samples as the test set, count the error rate of the weak classifier on the benign samples, and calculate the weight update factor;

[0031] Calculate weights based on the weight update factor.

[0032] Based on the same inventive concept, the second aspect of the present invention provides a traffic classification system based on smooth noise data enhancement, comprising:

[0033] The noise generation module is used to generate uniform normalized noise, and process the normalized noise using the cumulative distribution function of the Gaussian function, ISRU function and inverse tangent function to convert it into characteristic noise;

[0034] The noise optimization module optimizes the noise shape using a gradient-based algorithm that uses a loss function based on the softmax probability of the traffic classifier. It also optimizes the noise scale using a modified Bayesian optimizer. Before optimization, the sample is split into several parts, and within each part, independent optimization processes are performed for both benign samples and each type of malicious sample.

[0035] a data enhancement module, configured to generate optimized smooth noise based on the optimized noise shape and noise scale, and add the smooth noise to the benign samples and the malicious samples respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0036] The ensemble learning module is used to uniformly label the enhanced benign and malicious samples as pseudo-malicious samples, add them to the original samples as a training set to train the traffic classifier, collect the classification results of the traffic classifier trained on multiple sets of enhanced samples, use the improved Boosting algorithm to calculate the weights, and perform weighted averaging on the classification results to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0037] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the traffic classification method based on smooth noise data enhancement described in the first aspect.

[0038] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the traffic classification method based on smooth noise data enhancement described in the first aspect is implemented.

[0039] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0040] The system of the present invention includes a noise generation module, a noise optimization module, a data enhancement module and an integrated learning module; the noise generation module generates unified normalized noise and uses three functions such as ISRU to convert the normalized noise into characteristic noise; the noise optimization module optimizes the noise shape through a gradient-based algorithm and optimizes the noise scale through an improved Bayesian optimizer; the data enhancement module generates optimized smooth noise based on the optimized noise shape and noise scale, and adds the noise to benign samples and malicious samples respectively to obtain enhanced samples; the integrated learning module uses the enhanced samples as pseudo-malicious samples, trains the traffic classifier, collects the results of the traffic classifiers trained under multiple groups of noise scales, and uses an improved Boosting algorithm to combine the classification results to obtain the final classification result. The present invention effectively optimizes the classification boundary of the traffic classifier, improves the recall rate of the traffic classifier for unknown types of malicious traffic, and enhances the generalization of the classification results. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 This is an overall flow chart of a traffic classification method based on smooth noise data enhancement according to an embodiment of the present invention;

[0043] Figure 2 A flow chart of the data enhancement and ensemble learning module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The key points and main inventive concepts of the present invention include:

[0045] (1) The system of the present invention generates characteristic noise through a noise generation module, uses noise shape factors and noise scale factors to characterize the relative noise distribution between different dimensions and the overall noise distribution in all dimensions, and optimizes the noise through noise shape optimization methods and noise scale optimization methods. The noise shape optimization method superimposes three special distribution functions and searches for the optimal noise shape factor through a gradient-based algorithm; the noise scale optimization method constructs loss functions for benign samples and malicious samples respectively. In order to improve the generalization of classification results, when enhancing benign samples, the noisy samples are set as known pseudo-malicious samples and the original malicious samples are set as unknown samples; when enhancing malicious samples, the malicious samples of a single category are set as known malicious samples and the remaining types of malicious samples are set as unknown samples; the optimized noise shape factor and noise scale factor can achieve the anisotropy of the noise shape and the smoothness of the noise scale, so that the enhanced samples can converge to the classification boundary of the traffic classifier, improving the generalization of the classification performance on real unknown malicious traffic.

[0046] (2) The present invention collects several groups of noise scale factors with the best optimization effect through the data enhancement module, combines the noise scale factors of benign samples and malicious samples into a noise scale factor group, generates characteristic noise through the noise scale factor group, and uses the characteristic noise to perform data enhancement on the original sample. Different factor groups improve the adaptability of characteristic noise to the heterogeneous features of the samples, so that the enhanced samples form a smooth classification boundary, providing a strict generalization guarantee for the classification performance.

[0047] (3) The integrated learning module of the present invention uniformly marks the enhanced benign samples and malicious samples as pseudo-malicious samples, adds them to the original samples, and uses them as training sets to train the traffic classifier. The trained classifier only learns the classification boundary under a single noise scale factor group. Therefore, the integrated learning module collects the classification results of multiple groups of trained weak classifiers, uses the improved Boosting algorithm to calculate the weights, and weights the classification results. The improved Boosting algorithm selects all benign samples as the test set, counts the error rate of the weak classifier on the benign samples, and calculates the weight update factor. The weighted classification results weaken the preference of smooth noise for malicious samples, maintain the recall rate of the classifier on benign samples, and improve the classification performance as a whole.

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0049] Example 1

[0050] The present invention discloses a traffic classification method based on smooth noise data enhancement, comprising:

[0051] S1: Generate uniform normalized noise, and use the cumulative distribution function of the Gaussian function, ISRU function (Inverse Square Root Unit activation function), and inverse tangent function to process the normalized noise and convert it into characteristic noise;

[0052] S2: The noise shape is optimized using a gradient-based algorithm that uses a loss function based on the softmax probability of the traffic classifier. The noise scale is optimized using a modified Bayesian optimizer. Before optimization, the sample is divided into several parts. In each part, independent optimization processes are performed on benign samples and each type of malicious sample.

[0053] S3: Generate optimized smooth noise based on the optimized noise shape and noise scale, and add the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include the enhanced benign sample and the enhanced malicious sample;

[0054] S4: The enhanced benign samples and malicious samples are uniformly marked as pseudo-malicious samples, added to the original samples as a training set to train the traffic classifier, and the classification results of the traffic classifier trained under multiple groups of enhanced samples are collected. The weights are calculated using the improved Boosting algorithm, and the classification results are weighted averaged to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0055] Specifically, the gradient-based algorithm in S2 uses a loss function based on the softmax probability of the traffic classifier, which can ensure that the optimized noise shape is close to the characteristics of the traffic sample; the noise scale is optimized through the improved Bayesian optimizer HEBO. The sample is divided into several parts before optimization. The optimization process is performed on each benign sample and malicious sample separately to ensure that a variety of noise scales can be obtained and the noise scale is close to the category boundary of the sample.

[0056] The improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation. The calculated weight can weaken the traffic classifier's preference for malicious samples and balance the classification performance of the classifier on all types of traffic samples.

[0057] In one embodiment, the normalized noise is converted into characteristic noise, and the noise conversion method used adopts the following formula:

[0058]

[0059] p i =F n,i (ε n,i ),i=1,2…d

[0060] Where Ψ represents the noise conversion function, ε n is the normalized noise, ε n Contains d dimensions, and ε n Obey the distribution Dn,ε n,i is the i-th dimension of the noise, F n,i is the cumulative distribution function of Dn, p i is the cumulative distribution function value of the i-th dimension, t is the noise scale factor, and is the target parameter for noise scale optimization. and is the noise shape factor, which is the target parameter for noise shape optimization. Shared by noise in all dimensions, The noise of a single dimension is unique, k is the subscript of the noise shape factor, and represents three special distribution functions: Gaussian function, ISRU function and inverse tangent function. is the cumulative distribution function of the kth distribution function.

[0061] In one embodiment, a noise shape optimization method is used to optimize the noise shape using a gradient-based algorithm. The original samples are used as a training set and the noisy samples are used as a test set during the optimization process. The loss function used in the optimization process is as follows:

[0062]

[0063]

[0064] in, is the loss function, and are the loss functions for misclassified samples and correctly classified samples, ε n is the normalized noise that follows the distribution Dn, x (ns) is the nsth original sample in the training set, the training set size is N, Θ is the noise shape factor set, Λ(Θ) is the regularization term, and λ is the hyperparameter that controls the regularization strength. is the indicator function, Ψ(ε n ) is the characteristic noise, f is the classification process of the traffic classifier, s is the scoring function of the traffic classifier, such as softmax probability, is the category space of traffic samples, and is the loss function for the misclassified samples and correctly classified samples of a certain category, c is a category in the category space, f is the classification result of the classifier on category c, s c is the scoring function value of category c.

[0065] In one embodiment, a noise scale optimization method is used to optimize the noise scale using a heteroscedastic evolutionary Bayesian optimizer (HEBO). Before optimization, the sample is divided into several parts. In each part, independent optimization processes are performed on benign samples and each type of malicious sample. The loss function used in the optimization process is as follows:

[0066] T={T 1 ,……,T ks}

[0067] T ks =x tr,ks ∪x te,ks

[0068]

[0069] Among them, T is the original sample set, T ks is the ksth sample, x tr,ks and x te,ks From T ks The training samples and test samples are divided into and are malicious samples and benign samples in the training samples, respectively. is a malicious sample of the ic category in the training sample; is the loss function of malicious samples of category ic, is the loss function of benign samples; Tr is the training set, Te is the test set, and Accuracy is the accuracy of the traffic classifier on the test set Te after training on the training set Tr; The training set is constructed for malicious samples of category ic, and the training set contains original benign samples and the original malicious sample of category ic Also includes enhanced samples and A training set constructed for benign traffic, which contains original benign samples and enhanced samples Samples marked as malicious in the training set; Te ks The test set contains the original benign samples and all categories of original malicious samples Enhanced sample of malicious traffic From the original sample Add noise to obtain; in order to obtain more pseudo malicious samples with more noise scales, the optimization process will cluster the original benign samples and enhance the samples A set of enhanced samples after adding noise to each type of benign sample.

[0070] In one embodiment, the data enhancement module is used to statistically optimize several groups of noise scaling factors with good results, generate smooth noise using the optimized noise shape factors and noise scaling factors, and perform data enhancement on the original samples using the smooth noise. The data enhancement process formula is as follows:

[0071]

[0072] Among them, Optimizer is the noise scale optimizer, ks is the number of samples, ic is a certain category, is the loss function of benign samples, tb ks is the optimized benign sample noise scale, is the loss function of malicious samples, is the optimized malicious sample noise scale sequence, Large returns the sequence The pth optimal factor in , is a factor group consisting of two noise factors, is the conversion function of normalized noise according to the noise factor group, x ks For the original sample, To enhance the sample.

[0073] Furthermore, an integrated learning module is used to uniformly mark the enhanced benign samples and malicious samples as pseudo-malicious samples, add them to the original samples, and use them as training sets to train the traffic classifier. The classification results of the traffic classifier trained under multiple sets of enhanced samples are collected, and the weights are calculated using the improved Boosting algorithm. The classification results are weighted to obtain the final classification results. The improved Boosting algorithm process is as follows:

[0074]

[0075] initialization

[0076] 1. Initial weight vector The weight calculation formula is as follows:

[0077]

[0078] in, Represents the iwth weight in the initial weight vector, Tr iw is the iwth training set, Te b is a test set that contains only benign samples.

[0079] 2. Call the traffic classifier Learner and obtain KS×P classifiers f1,…,f according to the training set Tr. KS×P .

[0080] 3. Calculate the classification results of f on Te f1(Te), ..., f K×P (Te).

[0081] Fornt=1,……,NT

[0082] 1. Normalize the weight vector:

[0083]

[0084] Among them, NT is the total number of iterations, represents the iw-th weight in the weight vector of the nt-th iteration, is the sum of weights;

[0085] 2. Calculate the classifier f in Te b The ntth sample x nt Error rate on:

[0086]

[0087] in, represents the iwth weight in the weight vector of the ntth iteration, f iw (x nt ) represents the iw-th classifier for the nt-th sample x nt The classification result, c(x nt ) represents the original category of the sample.

[0088] 3. Calculate the weight update factor:

[0089]

[0090] 4. Set the new weight vector as follows:

[0091]

[0092] Output the final classification results

[0093]

[0094] Example 2

[0095] Based on the same inventive concept, this embodiment discloses a traffic classification system based on smooth noise data enhancement, see Figure 1 ,include:

[0096] The noise generation module is used to generate uniform normalized noise, and process the normalized noise using the cumulative distribution function of the Gaussian function, ISRU function and inverse tangent function to convert it into characteristic noise;

[0097] The noise optimization module optimizes the noise shape using a gradient-based algorithm that uses a loss function based on the softmax probability of the traffic classifier. It also optimizes the noise scale using a modified Bayesian optimizer. Before optimization, the sample is split into several parts, and within each part, independent optimization processes are performed for both benign samples and each type of malicious sample.

[0098] a data enhancement module, configured to generate optimized smooth noise based on the optimized noise shape and noise scale, and add the smooth noise to the benign samples and the malicious samples respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples;

[0099] The ensemble learning module is used to uniformly label the enhanced benign and malicious samples as pseudo-malicious samples, add them to the original samples as a training set to train the traffic classifier, collect the classification results of the traffic classifier trained on multiple sets of enhanced samples, use the improved Boosting algorithm to calculate the weights, and perform weighted averaging on the classification results to obtain the final classification results. Among them, the improved Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

[0100] This paper provides a system for improving the generalization of traffic classification based on smooth noise data enhancement. This system optimizes the noise shape and scale using a gradient-based search algorithm, and uses the optimized smooth noise to enhance the training set data. This enhanced training set enables the traffic classifier to learn smoother classification boundaries, improving the generalization of classification performance for unknown malicious samples.

[0101] Specifically, the noise generation module and the noise optimization module generate normalized noise and convert the normalized noise into characteristic noise using the optimized noise shape factor and noise scale factor.

[0102] The data augmentation module receives characteristic noise, adds noise to the original samples, and generates enhanced samples. The original and enhanced samples are then mixed to create a hybrid sample. (The data augmentation module splits the training set into multiple training subsets, each of which is used to optimize a set of noise scales. Each set of noise scales generates a corresponding batch of enhanced samples. The traffic classifier is trained on each batch of enhanced samples and produces classification results.)

[0103] The ensemble learning module trains weak classifiers on mixed samples, collects the classification results of weak classifiers on unknown types of malicious traffic, combines the classification results using an improved boosting algorithm, and weights the weak classifiers into a strong classifier.

[0104] The detailed process of the data enhancement and integrated learning module provided by the present invention is as follows Figure 2 As shown, the basic steps are as follows:

[0105] A1 divides the training set into ks mutually disjoint sub-training sets;

[0106] A2 applies p groups of different smooth noise to each sub-training set to obtain ks×p groups of enhanced training sets;

[0107] A3 sets the enhanced training set as the training set and the unknown malicious samples as the test set, trains the weak classifier for classification, and collects the classification results;

[0108] A4 uses an improved boosting algorithm to calculate the weights of the classification results and weights the classification results into the final result.

[0109] Since the system described in Example 2 of the present invention is the system used to implement the traffic classification method based on smoothed noise data enhancement described in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of this system based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All systems used in the method described in Example 1 of the present invention fall within the scope of protection of the present invention.

[0110] Example 3

[0111] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0112] Since the computer-readable storage medium described in Example 3 of the present invention is the computer-readable storage medium used to implement the traffic classification method based on smoothed noise data enhancement described in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer-readable storage medium based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All computer-readable storage media used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0113] Example 4

[0114] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first embodiment when executing the program.

[0115] Since the computer device described in Example 4 of the present invention is the computer device used to implement the traffic classification method based on smoothed noise data enhancement in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer device based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All computer devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0116] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0117] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0118] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, the present invention is intended to include such changes and modifications to the embodiments of the present invention if they fall within the scope of the claims and their equivalents.

Claims

1. A traffic classification method based on smooth noise data enhancement, characterized in that: include: Generate uniform normalized noise, and use the cumulative distribution function of Gaussian function, ISRU function and inverse tangent function to process the normalized noise and convert it into characteristic noise; The noise shape is optimized using a gradient-based algorithm that uses a loss function based on the softmax probability of the traffic classifier. The noise scale is optimized using a modified Bayesian optimizer (HEBO). Before optimization, the sample is divided into several parts. Within each part, independent optimization processes are performed for benign samples and each type of malicious sample. generating optimized smooth noise according to the optimized noise shape and noise scale, and adding the smooth noise to the benign sample and the malicious sample respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples; The enhanced benign and malicious samples are uniformly labeled as pseudo-malicious samples and added to the original samples as a training set to train the traffic classifier. The classification results of the traffic classifier trained on multiple sets of enhanced samples are collected, and the weights are calculated using the Boosting algorithm. The classification results are weighted averaged to obtain the final classification result. The Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

2. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: The formula used to convert normalized noise into characteristic noise is: in, represents the noise conversion function, is the normalized noise, contains d dimensions, and Obey the distribution Dn, is the i-th dimension of the noise, express The corresponding noise characteristics, is the cumulative distribution function of Dn, is the cumulative distribution function value of the i-th dimension, t is the noise scale factor, and is the target parameter for noise scale optimization. and is the noise shape factor, which is the target parameter for noise shape optimization. Shared by noise in all dimensions, The noise of a single dimension is unique, k is the subscript of the noise shape factor, and represents three special distribution functions: Gaussian function, ISRU function and inverse tangent function. is the cumulative distribution function of the kth distribution function.

3. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: The noise shape is optimized using a gradient-based algorithm. The original samples are used as the training set, and the noisy samples are used as the test set. The loss function used in the optimization process is as follows: in, is the loss function of the noise shape optimization process, and are the loss functions for misclassified samples and correctly classified samples, respectively. is the normalized noise obeying the distribution Dn, For the training set original samples, the training set size is N, is the set of noise shape factors, is the regularization term, is a hyperparameter that controls the strength of regularization. is the indicator function, is the characteristic noise, is the classification process of the traffic classifier, is the scoring function of the traffic classifier, is the category space of traffic samples, and is the loss function for the misclassified samples and correctly classified samples of a certain category, is a category in the category space, For the classifier in category The classification results on For category The scoring function value of .

4. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: When optimizing the noise scale through the improved Bayesian optimizer, the loss functions used include: in, is the original sample set, For the samples, and From The training samples and test samples are divided into and are malicious samples and benign samples in the training samples, respectively. is a malicious sample of category ic in the training sample, is the category space of traffic samples; is the loss function of malicious samples of category ic, is the loss function of benign samples; is the training set, is the test set, For the traffic classifier in the training set After training on the test set Accuracy on A training set constructed for malicious samples of category ic, which contains original benign samples and the original malicious sample of category ic , also contains enhanced samples and ; A training set constructed for benign traffic, which contains original benign samples and enhanced samples , Marked as malicious samples in the corresponding training set; The test set contains the original benign samples and all categories of original malicious samples ; Enhanced samples of malicious traffic From the original sample Add noise to get; enhance the sample is the set of enhanced samples after adding noise to each type of benign sample, is the normalized noise, is the noise conversion function.

5. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: Smooth noise is added to benign and malicious samples respectively to obtain enhanced samples, including: Split the training set into multiple training subsets, where each training subset includes benign samples and malicious samples, and each subset is used to optimize a set of noise scales; Generate a corresponding batch of enhanced samples for each set of noise scales.

6. The traffic classification method based on smooth noise data enhancement according to claim 5, characterized in that: The enhanced samples are obtained as follows: in, is the noise scale optimizer, is the number of samples, For a certain category, is the loss function of benign samples, is the optimized benign sample noise scale, is the loss function of malicious samples, is the optimized malicious sample noise scale sequence, Return sequence Middle The optimal factor, is a factor group consisting of two noise factors, is the category space of traffic samples, is the conversion function of normalized noise according to the noise factor group, For the original sample, For the enhanced sample, is the normalized noise.

7. The traffic classification method based on smooth noise data enhancement according to claim 1, characterized in that: The weights are calculated using the Boosting algorithm, including: Select all benign samples as the test set, count the error rate of the weak classifier on the benign samples, and calculate the weight update factor; Calculate weights based on the weight update factor.

8. A traffic classification system based on smooth noise data enhancement, characterized in that include: The noise generation module is used to generate uniform normalized noise, and process the normalized noise using the cumulative distribution function of the Gaussian function, ISRU function and inverse tangent function to convert it into characteristic noise; The noise optimization module optimizes the noise shape using a gradient-based algorithm that uses a loss function based on the softmax probability of the traffic classifier. The noise scale is optimized using a modified Bayesian optimizer (HEBO). Before optimization, the sample is divided into several parts. In each part, independent optimization processes are performed on benign samples and each type of malicious sample. a data enhancement module, configured to generate optimized smooth noise based on the optimized noise shape and noise scale, and add the smooth noise to the benign samples and the malicious samples respectively to obtain enhanced samples, wherein the enhanced samples include enhanced benign samples and enhanced malicious samples; The ensemble learning module is used to uniformly label the enhanced benign and malicious samples as pseudo-malicious samples, add them to the original samples as a training set to train the traffic classifier, collect the classification results of the traffic classifier trained on multiple sets of enhanced samples, use the Boosting algorithm to calculate the weights, and perform weighted averaging on the classification results to obtain the final classification result. The Boosting algorithm uses the recall rate of the traffic classifier on benign samples as the basis for weight calculation.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the traffic classification method based on smooth noise data enhancement according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the traffic classification method based on smooth noise data enhancement according to any one of claims 1 to 7 is implemented.

Images