Malicious traffic detection method based on multi-instance learning
Through the multi-instance learning framework and attention mechanism, combined with convolutional neural networks, the accuracy and robustness problems of malicious traffic detection in encrypted traffic environments are solved, and efficient identification of encrypted traffic and detection of sensitive data transmission patterns are achieved.
Patent Information
- Application Number
- CN202510643963.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-19
- Publication Date
- 2025-09-05
AI Technical Summary
Existing technologies have difficulty accurately identifying malicious traffic in an encrypted traffic environment, especially identifying sensitive data transmission patterns in mixed background traffic and encrypted tunnels. Deep learning models also have low detection accuracy due to imbalanced training data and interference from irrelevant traffic.
A multi-instance learning framework is adopted to aggregate network flows into a packet-instance structure. Combined with the attention mechanism and convolutional neural network, the spatiotemporal patterns of encrypted traffic are identified through burst segmentation, feature extraction and aggregation, thereby improving detection accuracy and robustness.
It effectively identifies malicious traffic in complex network environments, improves detection accuracy and robustness, and can uncover hidden malicious patterns even when some instances appear benign, adapting to network security protection needs.
Smart Images
Figure CN120602122A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of malicious traffic detection, and in particular to a malicious traffic detection method based on multi-instance learning. Background Art
[0002] With the rapid development of network communication technology, encryption protocols are becoming increasingly widespread. Encryption protocols such as TLS / SSL have become essential for ensuring secure data transmission. However, while this trend provides security for legitimate data, it also presents significant challenges to network security. Encryption technology allows malicious traffic to be concealed within legitimate network traffic, significantly limiting traditional methods for detecting malicious traffic.
[0003] Traditional malicious traffic detection technologies, such as deep packet inspection (DPI) and signature-based detection methods, rely primarily on analyzing packet payload content or matching pre-defined attack patterns. However, when dealing with encrypted traffic, these methods are unable to obtain effective information due to the encryption of the packet payload, resulting in a significant decline in detection capabilities. This makes it difficult to identify malicious activities hidden in encrypted channels, and it is also impossible to detect abnormal transmission of sensitive data through encrypted tunnels.
[0004] While statistical analysis and machine learning-based methods shift their focus to traffic-level features such as packet size, inter-arrival time, and flow duration, avoiding reliance on payload content, they still face numerous challenges in complex real-world network environments. For one thing, in mixed background traffic scenarios, malicious traffic is often intertwined with a large amount of benign traffic, and malicious signals are sparse and weak, making it difficult for these methods to accurately separate malicious traffic from massive amounts of traffic. Furthermore, interference from irrelevant traffic also complicates detection. This irrelevant traffic introduces noise, reducing the accuracy of the detection system and affecting the accurate identification of malicious patterns. More critically, existing technologies are unable to identify sensitive data transmission patterns within encrypted tunnels through traffic behavior characteristics.
[0005] For example, in an enterprise network environment, normal office business traffic and employee personal network access traffic coexist with potentially malicious traffic. Traditional methods struggle to accurately detect malicious traffic without disrupting normal business operations. When sensitive data is transmitted as abnormal traffic through encrypted tunnels, existing systems are unable to identify its transmission path or infer potential risks based on traffic behavior characteristics. Furthermore, when new malware or attack methods emerge in the network, the effectiveness of traditional detection methods is further reduced due to their lack of adaptability to unknown threats.
[0006] In recent years, deep learning technologies have been widely used in the field of network security, with convolutional neural networks (CNNs) and recurrent neural networks (RNNs) being used to analyze network traffic data. However, these deep learning-based methods also face challenges in practical applications. In mixed background traffic environments, malicious traffic accounts for a very small proportion of the large amount of benign traffic, resulting in imbalanced training data and making it difficult for the model to learn effective malicious traffic characteristics. Interference from irrelevant traffic also affects detection accuracy and reduces model reliability. Furthermore, deep learning models are typically black-box models, making it difficult to conduct effective root cause analysis of detected threats and unable to correlate traffic behavior anomalies in cross-border transmission of sensitive data.
[0007] The emergence of graph neural networks (GNNs) has brought new insights to malicious traffic detection. By representing network traffic as a graph structure, they can capture the spatial and temporal dependencies between traffic flows. However, existing GNN-based methods still have some limitations in practical applications. Most methods can only capture shallow interactions when aggregating node features and are unable to deeply explore hierarchical or multi-scale interaction patterns, such as session-level patterns. When processing large-scale network traffic, GNNs have high computational complexity, making it difficult to meet real-time processing requirements. They also lack the ability to analyze sensitive data transmission behaviors in encrypted tunnels.
[0008] In summary, current detection of encrypted malicious traffic faces numerous challenges, with both traditional detection methods and emerging technologies exhibiting limitations. Especially in scenarios where sensitive data is transmitted across borders via encrypted tunnels, there is an urgent need for detection technologies that can identify abnormal patterns through traffic behavior characteristics. Summary of the Invention
[0009] The present invention proposes a method for detecting encrypted malicious traffic based on multi-instance learning. By aggregating network flows into packets, using an attention mechanism to screen key instances, and combining burst segmentation with feature extraction technology based on convolutional neural networks (CNN), the method aims to address the shortcomings of existing technologies in detecting encrypted malicious traffic. By analyzing the spatiotemporal patterns of encrypted traffic, the behavioral characteristics of sensitive data transmitted through abnormal tunnels are identified, the accuracy and robustness of detection are improved, and a more effective means for network security protection and sensitive data outbound channel detection is provided to solve the problems raised in the above-mentioned background technology.
[0010] To achieve the above objectives, the present invention provides the following technical solution: a malicious traffic detection method based on multi-instance learning, comprising the following steps:
[0011] Step 1, burst segmentation phase: First, the original encrypted network traffic is structured and segmented in the time dimension. The continuous network flow sequence is dynamically divided into multiple short burst segments with temporal locality through a sliding window mechanism.
[0012] Step 2, feature extraction stage: First, the burst-segmented and normalized packet size sequence is input into the convolutional neural network, and high-level features are extracted layer by layer through multi-layer convolution operations;
[0013] Step 3: Traffic aggregation and attention pooling: The model achieves high-level semantic modeling of complex encrypted traffic patterns through multi-stream feature aggregation and dynamic weight allocation.
[0014] Step 4, fully connected layer classification stage: In the fully connected layer classification stage, the model uses a fully connected neural network to pool the packet-level features B′ generated by attention i Mapped to the final malicious traffic probability output.
[0015] Preferably, in the step 1, burst segmentation stage, the window size is configured according to the actual network load and processing capacity, and each slide is performed with a set step size of 50%-80% of the window size, and overlapping movement is performed to ensure time resolution to capture short-term traffic fluctuations and reduce the loss of key features through overlapping areas. For each network flow, starting from the start time, the time series containing continuous data packets is intercepted in sequence according to the window boundary to form an ordered set of burst segments, and the data packet sizes in each burst segment are arranged in chronological order as follows: Where T is the number of packets in the segment. For incomplete windows at the beginning or end of the flow, adaptive boundary processing is used: the burst segment that is less than the window length at the beginning is directly retained as the actual packet size sequence, preserving the original timing characteristics;
[0016] At the end stage, if the remaining data packets are less than the window size, zero padding is selected to align the sequence length with the window by padding with zeros. This is suitable for scenarios that require a fixed input dimension.
[0017] Preferably, after the segmentation is completed, the data packet size of each burst segment is normalized, and the value is scaled to the interval [0,1] using the minimum-maximum normalization method. The specific formula is:
[0018]
[0019] where x min x max are the minimum and maximum packet sizes in the current burst segment, respectively. By eliminating the scale differences of different traffic sizes, it ensures that the input sequence in the subsequent CNN network feature extraction has a uniform numerical distribution, thereby improving the model's learning efficiency for local patterns.
[0020] Preferably, in the step 2, feature extraction stage, for the standardized sequence of each burst segment:
[0021]
[0022] Use a learnable convolution kernel W k Perform sliding window convolution, combined with bias term b k Generate feature maps The calculation formula is:
[0023]
[0024] This operation captures the adjacent dependencies of packet sizes through the local receptive field and applies the ReLU activation function after convolution:
[0025] ReLU(x)=max(0,x)
[0026] The model's ability to express complex patterns is enhanced through nonlinear transformations, highlighting positive abnormal features such as sudden increases in traffic. Subsequently, a maximum pooling operation is performed to select the maximum value in each local area to generate a pooled feature:
[0027]
[0028] This step reduces computational complexity by reducing dimensionality while retaining the most significant features and suppressing background noise.
[0029] Preferably, the number and size of convolution kernels can be adjusted according to the actual traffic carrying limit, and the step size and window size of the pooling layer can match the convolution operation to ensure the alignment of feature dimensions, and finally generate a high-level feature vector containing local temporal patterns and significant features, providing discriminative flow-level feature representation for subsequent multi-instance package construction.
[0030] Preferably, in the step three, the traffic aggregation and attention pooling stage, all flow-level features belonging to the same source-destination address pair are grouped and aggregated based on the triplet of network communication, namely, source IP, destination IP, and protocol;
[0031] For each address pair (S, D), the corresponding instance package B i All flows F under this session j Feature vector extracted by CNN constitute;
[0032] Right now
[0033]
[0034] in It is the high-level feature representation of the j-th flow after burst segmentation, which contains the local dependency pattern of the packet size sequence.
[0035] The subsequent attention pooling mechanism uses adaptive weight allocation to address the feature interference problem caused by the coexistence of malicious and benign flows in mixed traffic.
[0036] The specific process is as follows: First, for each flow feature in the instance package Perform nonlinear transformation of feature space through learnable attention weight matrix W a , the dimension is d×1, d is the feature vector dimension, and the raw attention score is calculated:
[0037]
[0038] This operation maps the flow features into the attention score space, highlighting the feature dimensions related to malicious patterns. Subsequently, the scores are normalized by the softmax function to generate the attention weight α in the form of a probability distribution. j .
[0039] Preferably, the weight represents the relative importance of the jth flow in detecting malicious behavior, that is, the flow containing periodic large packet transmission will get a high weight, while the stable web browsing flow will have a lower weight. Finally, the packet-level feature vector B′ is generated by weighted summation. i :
[0040]
[0041] The essence of this process is to construct an attention mask in the feature space, dynamically amplify the feature contribution of the key stream, and suppress background noise.
[0042] Preferably, in step 4, the fully connected layer classification stage:
[0043] First, B′ i Input to the fully connected layer, which contains the learnable weight matrix W c ∈R d×1 and the bias term b c , where d is the dimension of the packet-level features. The fully connected layer converts the input features into an intermediate representation through linear transformation:
[0044]
[0045] This process is equivalent to taking a weighted sum of each element of the feature vector, adding a bias, and then introducing the Sigmoid activation function. Compress the linear output to the [0,1] interval to generate malicious probability
[0046] The training process uses the binary cross entropy loss function, whose mathematical expression is:
[0047]
[0048] where y i ∈{0, 1} is the true label, and the loss function guides model optimization by penalizing the degree of deviation between the predicted probability and the true label.
[0049] Compared with the prior art, the present invention has the following beneficial effects:
[0050] This paper proposes a malicious encrypted traffic detection model based on a multi-instance learning framework. Its core innovation lies in the introduction of a "bag-instance" structure to adapt to the complexity of traffic behavior in real network environments. In actual network communications, a communication pair (such as the communication between an IP address and a server) often contains multiple different types of traffic, such as normal web page access, email sending and receiving, backend service communication, and potential malicious command communication. These flows may have a high degree of overlap in packet size and timing characteristics, which poses great difficulties for traditional detection methods based on single-flow judgment.
[0051] Multi-instance learning aggregates multiple flows within the same communication pair into a single "bag" and treats each flow as an "instance." This allows for end-to-end modeling without explicitly labeling each flow. Specifically, the system labels an entire bag as "malicious" or "normal," but does not require individual labeling for each flow. This approach better reflects the real-world data characteristic of "some abnormal behavior mixed in with normal communication." This modeling approach is inherently robust, capable of extracting implicit malicious patterns from the overall bag even when some instances appear benign. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0053] Figure 1 This is a processing flow chart of a malicious traffic detection method based on multi-instance learning of the present invention. DETAILED DESCRIPTION
[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0055] See also Figure 1 , the present invention provides a technical solution:
[0056] A malicious traffic detection method based on multi-instance learning includes the following steps:
[0057] Step 1, burst segmentation stage: First, perform structured segmentation of the original encrypted network traffic in the time dimension, and dynamically divide the continuous network flow sequence into multiple short burst segments with time locality through the sliding window mechanism. In the specific operation, the window size is configured according to the actual network load and processing capacity, and each sliding is performed with a set step size (usually 50%-80% of the window size) for overlapping movement, which not only ensures the time resolution to capture short-term traffic fluctuations, but also reduces the loss of key features through overlapping areas. For each network flow, starting from the start time, the time series containing continuous data packets are intercepted in sequence according to the window boundary to form an ordered set of burst segments. The size of the data packets in each burst segment is arranged in chronological order as follows: Where T is the number of packets in the segment. For incomplete windows at the beginning or end of the flow, adaptive boundary processing is used: burst segments that are less than the window length at the beginning directly retain the actual packet size sequence, preserving the original timing characteristics; at the end, if the remaining packets are less than the window size, zero padding can be selected (zero padding is used to align the sequence length with the window, which is suitable for scenarios that require a fixed input dimension). After the segmentation is completed, the packet size of each burst segment is standardized, and the minimum-maximum normalization method is used to scale the value to the [0,1] interval. The specific formula is:
[0058]
[0059] where x min x max are the minimum and maximum packet sizes in the current burst segment, respectively. By eliminating the scale differences of different traffic sizes, it ensures that the input sequence in the subsequent CNN network feature extraction has a uniform numerical distribution, thereby improving the model's learning efficiency for local patterns.
[0060] Step 2, feature extraction stage: First, the packet size sequence after burst segmentation and normalization is input into the convolutional neural network, and high-level features are extracted layer by layer through multi-layer convolution operations. The specific process is: for each burst segment normalized sequence Use a learnable convolution kernel W k Perform sliding window convolution, combined with bias term b k Generate feature maps The calculation formula is:
[0061]
[0062] This operation captures the adjacent dependencies of packet sizes through local receptive fields. The ReLU activation function is applied after convolution:
[0063] ReLU(x)=max(0,x)
[0064] The model's ability to express complex patterns is enhanced through nonlinear transformations, highlighting positive abnormal features such as sudden increases in traffic. A maximum pooling operation is then performed, selecting the maximum value in each local area to generate a pooled feature:
[0065]
[0066] This step reduces computational complexity through dimensionality reduction, while preserving the most salient features and suppressing background noise. Throughout this process, the number and size of convolution kernels can be adjusted based on actual traffic load limits. The stride and window size of the pooling layer are matched to the convolution operation to ensure feature dimension alignment. Ultimately, a high-level feature vector containing local temporal patterns and salient features is generated, providing discriminative flow-level feature representations for subsequent multi-instance packet construction.
[0067] Step 3, traffic aggregation and attention pooling stage: The model achieves high-level semantic modeling of complex encrypted traffic patterns through multi-stream feature aggregation and dynamic weight allocation mechanism. First, based on the triple of network communication (source IP, destination IP, protocol), all flow-level features belonging to the same source-destination address pair are grouped and aggregated. For each address pair (S, D), its corresponding instance package B i All flows F under this session j Feature vector extracted by CNN
[0068] Composition, that is
[0069]
[0070] in It is the high-level feature representation of the jth flow after burst segmentation, and contains the local dependency pattern of packet size sequences. This aggregation method breaks through the limitations of single-flow analysis and can capture cross-flow coordinated attack characteristics.
[0071] The following attention pooling mechanism solves the feature interference problem of malicious and benign flows in mixed traffic by adaptive weight distribution. The specific process is as follows: First, for each flow feature in the instance packet Perform nonlinear transformation of feature space through learnable attention weight matrix W a (dimension is d×1, d is the feature vector dimension) Calculate the raw attention score:
[0072]
[0073] This operation maps the flow features into the attention score space, highlighting the feature dimensions related to malicious patterns. Subsequently, the scores are normalized by the softmax function to generate the attention weights α in the form of a probability distribution j .
[0074] This weight characterizes the relative importance of the jth flow in detecting malicious behavior - for example, a flow containing periodic large packet transmissions (which may correspond to C&C communication) will receive a high weight, while a stable web browsing flow (benign) will receive a low weight. Finally, the packet-level feature vector B′ is generated by weighted summation. i :
[0075]
[0076] This process essentially constructs an "attention mask" in the feature space, dynamically amplifying the feature contributions of key streams and suppressing background noise. The core innovation of this phase lies in combining the "bag-instance" hierarchy of multi-instance learning with the attention mechanism. This not only retains the advantages of multi-stream collaborative modeling, but also enables refined differentiation of complex patterns through data-driven weight allocation.
[0077] Step 4: In the fully connected layer classification stage, the model uses a fully connected neural network to pool the packet-level features B′ generated by attention i Mapped to the final malicious traffic probability output. In the specific implementation, first B′ i Input to the fully connected layer, which contains the learnable weight matrix W c ∈R d×1 and the bias term b c , where d is the dimension of the packet-level features. The fully connected layer converts the input features into an intermediate representation through linear transformation:
[0078]
[0079] This process is equivalent to taking a weighted sum of each element of the feature vector and adding a bias. The Sigmoid activation function is then introduced. Compress the linear output to the [0,1] interval to generate malicious probability
[0080] The training process uses the binary cross entropy loss function, whose mathematical expression is:
[0081]
[0082] where y i ∈{0, 1} is the true label. This loss function guides model optimization by penalizing the degree of deviation between the predicted probability and the true label.
[0083] This paper proposes a method for detecting malicious encrypted traffic based on a multi-instance learning framework. This method uses burst segmentation to capture dynamic short-term traffic characteristics, combines it with a CNN to extract local dependency patterns in packet size sequences, and uses an attention mechanism to dynamically focus on key flow features. This approach builds an end-to-end architecture for multi-flow collaborative modeling. This provides an efficient solution for detecting malicious traffic threats and encrypted sensitive data outbound channels in encrypted network environments.
[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A malicious traffic detection method based on multi-instance learning, characterized by: The following steps are involved: Step 1, burst segmentation phase: First, the original encrypted network traffic is structured and segmented in the time dimension. The continuous network flow sequence is dynamically divided into multiple short burst segments with temporal locality through a sliding window mechanism. Step 2, feature extraction stage: First, the burst-segmented and normalized packet size sequence is input into the convolutional neural network, and high-level features are extracted layer by layer through multi-layer convolution operations; Step 3: Traffic aggregation and attention pooling: The model achieves high-level semantic modeling of complex encrypted traffic patterns through multi-stream feature aggregation and dynamic weight allocation. Step 4, fully connected layer classification stage: In the fully connected layer classification stage, the model uses a fully connected neural network to generate packet-level features B′ generated by attention pooling i Mapped to the final malicious traffic probability output.
2. The method for detecting malicious traffic based on multi-instance learning according to claim 1, characterized in that: In the first step, during the burst segmentation phase, the window size is configured according to the actual network load and processing capacity. Each slide is performed with a set step size of 50%-80% of the window size, and overlapping movement is performed to ensure time resolution to capture short-term traffic fluctuations and reduce the loss of key features through overlapping areas. For each network flow, starting from the start time, the time series containing continuous data packets is intercepted in sequence according to the window boundary to form an ordered set of burst segments. The data packet sizes in each burst segment are arranged in chronological order as follows: Where T is the number of packets in the segment. For incomplete windows at the beginning or end of the flow, adaptive boundary processing is used: the burst segment that is less than the window length at the beginning is directly retained as the actual packet size sequence, preserving the original timing characteristics; At the end stage, if the remaining data packets are less than the window size, zero padding is selected to align the sequence length with the window by padding with zeros. This is suitable for scenarios that require a fixed input dimension.
3. The method for detecting malicious traffic based on multi-instance learning according to claim 2, characterized in that: After the segmentation is completed, the packet size of each burst segment is normalized and the value is scaled to the [0,1] interval using the minimum-maximum normalization method. The specific formula is: where x min x max are the minimum and maximum packet sizes in the current burst segment, respectively. By eliminating the scale differences of different traffic sizes, it ensures that the input sequence in the subsequent CNN network feature extraction has a uniform numerical distribution, thereby improving the model's learning efficiency for local patterns.
4. The method for detecting malicious traffic based on multi-instance learning according to claim 1, characterized in that: In the second step, the feature extraction stage, for the standardized sequence of each burst segment: Use a learnable convolution kernel W k Perform sliding window convolution, combined with bias term b k Generate feature maps The calculation formula is: This operation captures the adjacent dependencies of packet sizes through the local receptive field and applies the ReLU activation function after convolution: ReLU(x)=max(0,x) The model's ability to express complex patterns is enhanced through nonlinear transformations, highlighting positive abnormal features such as sudden increases in traffic. Subsequently, a maximum pooling operation is performed to select the maximum value in each local area to generate a pooled feature: This step reduces computational complexity by reducing dimensionality while retaining the most significant features and suppressing background noise.
5. The method for detecting malicious traffic based on multi-instance learning according to claim 4, characterized in that: The number and size of convolution kernels can be adjusted according to the actual traffic carrying limit. The stride and window size of the pooling layer match the convolution operation to ensure the alignment of feature dimensions. Ultimately, a high-level feature vector containing local temporal patterns and significant features is generated, providing discriminative flow-level feature representation for subsequent multi-instance package construction.
6. The method for detecting malicious traffic based on multi-instance learning according to claim 1, characterized in that: In the third step, the traffic aggregation and attention pooling stage, all flow-level features belonging to the same source-destination address pair are grouped and aggregated based on the triplet of network communication, namely source IP, destination IP, and protocol; For each address pair (S, D), the corresponding instance package B i All flows F under this session j Feature vector extracted by CNN constitute; Right now in It is the high-level feature representation of the j-th flow after burst segmentation, which contains the local dependency pattern of the packet size sequence. The subsequent attention pooling mechanism uses adaptive weight allocation to address the feature interference problem caused by the coexistence of malicious and benign flows in mixed traffic. The specific process is as follows: First, for each flow feature in the instance package Perform nonlinear transformation of feature space through learnable attention weight matrix W a , the dimension is d×1, d is the feature vector dimension, and the raw attention score is calculated: This operation maps the flow features into the attention score space, highlighting the feature dimensions related to malicious patterns. Subsequently, the scores are normalized by the softmax function to generate the attention weight α in the form of a probability distribution. j .
7. The method for detecting malicious traffic based on multi-instance learning according to claim 6, characterized in that: This weight represents the relative importance of the jth flow in detecting malicious behavior. That is, the flow containing periodic large packet transmission will get a high weight, while the stable web browsing flow will have a lower weight. Finally, the packet-level feature vector B′ is generated by weighted summation. i : The essence of this process is to construct an attention mask in the feature space, dynamically amplify the feature contribution of the key stream, and suppress background noise.
8. The method for detecting malicious traffic based on multi-instance learning according to claim 1, characterized in that: Step 4, fully connected layer classification stage: First, B′ i Input to the fully connected layer, which contains the learnable weight matrix and the bias term b c , where d is the dimension of the packet-level features. The fully connected layer converts the input features into an intermediate representation through linear transformation: This process is equivalent to taking a weighted sum of each element of the feature vector, adding a bias, and then introducing the Sigmoid activation function. Compress the linear output to the [0,1] interval to generate malicious probability The training process uses the binary cross entropy loss function, whose mathematical expression is: where y i ∈{0, 1} is the true label, and the loss function guides model optimization by penalizing the degree of deviation between the predicted probability and the true label.