Method for generating detection model of malicious traffic, storage medium, and electronic device

Abstract

The application discloses a method for generating a malicious traffic detection model, a storage medium and an electronic device. The method comprises: obtaining a plurality of Tor traffic data, and constructing the plurality of Tor traffic data into a plurality of standardized traffic sequences respectively. A plurality of different scale feature data of the plurality of traffic sequences are determined, and the plurality of different scale feature data comprises a first behavior feature of a data block scale, a transmission direction feature of a traffic sequence scale and a second behavior feature of a data flow scale. Training samples are constructed based on the first behavior feature, the transmission direction feature and the second behavior feature of the plurality of traffic sequences respectively. The classification model is trained by using the training samples to obtain a detection model, and the detection model can determine whether the to-be-detected Tor traffic data is malicious traffic. By using the three scale features, the traffic is described from three dimensions of microscopic interaction, direction mode and macroscopic evolution, the one-sidedness of a single granularity feature is overcome, and accurate identification of the malicious traffic is realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and more specifically, to a method for generating a malicious traffic detection model, a storage medium, and an electronic device. Background Technology

[0002] With the widespread use of the Internet and the increasing demand for Internet privacy protection, The Onion Router (Tor), with its multi-hop relay and layered encryption mechanism, has become a key communication network for people to achieve anonymous communication, circumvent censorship, and protect sensitive information.

[0003] However, due to the anonymity of the Tor network, it is easily abused by malware, remote control programs, botnets, ransomware, and other attack tools for covert communication, command issuance, data transmission, and attacks on organizations.

[0004] However, the Tor protocol uses a fixed-byte cell as the smallest unit of transmission, and all communication data is encapsulated within this fixed-size structure. Therefore, it is impossible to detect malicious traffic based on packet length variations, payload content differences, or protocol header characteristics, making it impossible to accurately identify malicious traffic in Tor. Summary of the Invention

[0005] This application provides a method for generating a malicious traffic detection model, a storage medium, and an electronic device to at least solve the problem in related technologies that malicious traffic in Tor cannot be accurately identified.

[0006] According to one embodiment of this application, a method for generating a malicious traffic detection model is provided, comprising: acquiring multiple Tor traffic data and constructing the multiple Tor traffic data into multiple standardized traffic sequences, wherein at least one of the multiple Tor traffic data is malicious traffic; determining feature data of the multiple traffic sequences at multiple different scales, wherein the feature data at multiple different scales includes a first behavioral feature at the data block scale, a transmission direction feature at the traffic sequence scale, and a second behavioral feature at the data stream scale; constructing training samples based on the first behavioral feature, the transmission direction feature, and the second behavioral feature of the multiple traffic sequences respectively; and training a classification model using the training samples to obtain a detection model, wherein the detection model is capable of determining whether the Tor traffic data to be detected is malicious traffic based on the first behavioral feature, the transmission direction feature, and the second behavioral feature of the Tor traffic data to be detected.

[0007] According to one embodiment of the present application, an apparatus for generating a malicious traffic detection model is provided, comprising:

[0008] The traffic acquisition module is used to acquire multiple Tor traffic data and construct the multiple Tor traffic data into multiple standardized traffic sequences, wherein at least one of the multiple Tor traffic data is malicious traffic;

[0009] The feature determination module is used to determine the feature data of multiple traffic sequences at multiple different scales, wherein the feature data at multiple different scales includes a first behavioral feature at the data block scale, a transmission direction feature at the traffic sequence scale, and a second behavioral feature at the data stream scale.

[0010] The sample construction module is used to construct training samples based on the first behavioral feature, the transmission direction feature, and the second behavioral feature of the multiple traffic sequences, respectively.

[0011] The training module is used to train the classification model using the training samples to obtain a detection model, wherein the detection model can determine whether the Tor traffic data to be detected is malicious traffic based on the first behavioral feature, transmission direction feature, and second behavioral feature of the Tor traffic data to be detected.

[0012] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute the above-described method for generating a malicious traffic detection model at runtime.

[0013] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the above-described method for generating a malicious traffic detection model through the computer program.

[0014] According to yet another embodiment of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0015] In this embodiment, the problem of traditional feature extraction failure caused by the fixed cell structure of Tor traffic is solved by constructing standardized traffic sequences. A unified data structure enables subsequent models to stably handle Tor streams of arbitrary length, providing a reusable and comparable data foundation for multi-scale behavior modeling, significantly improving the reliability of feature extraction and the convergence efficiency of model training. Through three-scale joint modeling, a three-dimensional characterization of behavior is achieved from local actions, interaction patterns, and overall trajectories, enhancing the ability to distinguish behavior patterns and providing highly discriminative input features for subsequent classification. By unifying multi-scale features into structured training samples, the problem of isolated features and inability to collaboratively make decisions in traditional methods is solved. Single features are easily affected by noise, while the concatenation of multiple features forms complementarity, improving the model's tolerance to complex behaviors. Automatic identification of malicious traffic is achieved through model training, giving the model generalization capabilities. Even when faced with malicious traffic not present in the training set, it can be effectively identified through similar behavior patterns, improving the accuracy of malicious traffic identification. By using features at three scales, traffic is characterized from three dimensions: micro-interaction, directional pattern, and macro-evolution. This overcomes the one-sidedness of single-granularity features and thus achieves accurate identification of malicious traffic. Attached Figure Description

[0016] Figure 1 This is a hardware structure block diagram of a computer terminal for generating an optional malicious traffic detection model according to an embodiment of this application.

[0017] Figure 2 This is one of the flowcharts for a method of generating a malicious traffic detection model according to an embodiment of this application;

[0018] Figure 3 This is a second flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0019] Figure 4 This is the third flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0020] Figure 5 This is the fourth flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0021] Figure 6 This is the fifth flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0022] Figure 7 This is the sixth flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0023] Figure 8This is the seventh flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0024] Figure 9 This is the eighth flowchart of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0025] Figure 10 This is flowchart nine of a method for generating a malicious traffic detection model according to an embodiment of this application;

[0026] Figure 11 This is a structural block diagram of a device for generating a malicious traffic detection model according to an embodiment of this application. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] The methods and embodiments provided in this application can be executed on a computer terminal or similar computing system. Taking running on a computer terminal as an example, Figure 1 This is a hardware structure block diagram of a computer terminal for generating a malicious traffic detection model according to an embodiment of this application. Figure 1 As shown, a computer terminal may include one or more ( Figure 1Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. In one exemplary embodiment, the computer terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, the computer terminal may also include components that are more complex than those described above. Figure 1 The more or fewer components shown, or having the same Figure 1 Equivalent functions or ratios shown Figure 1 The functions shown have more different configurations.

[0030] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the method for generating a malicious traffic detection model in this embodiment. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thus implementing the aforementioned method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage systems, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0031] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the computer terminal. In one example, the transmission device 106 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet.

[0032] This embodiment provides a method for generating a malicious traffic detection model, applied to the aforementioned computer terminal. The method is described in detail below, along with its execution flow. Figure 2 As shown, the method includes the following steps S200-230:

[0033] Step S200: Obtain multiple Tor traffic data points and construct multiple standardized traffic sequences from the multiple Tor traffic data points respectively.

[0034] Among these, at least one of the Tor traffic data points is malicious traffic.

[0035] Specifically, the Tor communication data captured in the original network is transformed into a structured, computable sequence form, serving as the basis for subsequent feature extraction and model training. The Tor network uses a fixed-length cell (512 bytes) as the basic transmission unit and is independent of payload content; therefore, traditional analysis methods based on packet length or payload characteristics cannot be used. By reorganizing the original data packets according to session or stream dimensions, interference caused by inconsistent data formats is eliminated, ensuring that all input samples have a uniform structure, laying a data consistency foundation for subsequent behavioral modeling.

[0036] For example, raw Tor communication data is collected from network mirror ports, traffic probes, or log systems. The raw packets are matched using a 5-tuple (source IP, source port, destination IP, destination port, transport layer protocol) to group packets belonging to the same communication session into a single traffic stream. Since Tor traffic consists of fixed 512-byte cells, each stream is represented as a sequence of cells. If the sequence lengths are inconsistent, sliding window truncation or zero-padding is used to standardize them to a fixed length (e.g., 200 cells), forming a standardized traffic sequence. Each sequence retains its original timestamp information for subsequent extraction of time interval features. Malicious traffic samples are sourced from labeled public datasets (e.g., CIRA-CIC-Tor2020) or attack behavior logs captured through honeypots, ensuring that the training set contains at least some known malicious Tor traffic samples.

[0037] Tor traffic data consists of encrypted communication data transmitted over the Tor network. Its basic transmission unit is a fixed 512-byte cell, and the communication path uses multi-hop relays to conceal the true identity. Standardized traffic sequences: Raw network data is reassembled by session and arranged chronologically into a uniform-length cell sequence. Each element in the sequence represents a cell and contains no plaintext content, retaining only behavioral metadata such as time and direction. Malicious traffic: Communication traffic generated by using the Tor network for malicious activities (such as C2 communication, ransomware data transmission, and botnet control). It exhibits implicit differences in behavioral patterns compared to legitimate anonymous browsing traffic.

[0038] Step S210: Determine the feature data of multiple flow sequences at multiple different scales.

[0039] Among them, the feature data at multiple different scales include the first behavioral feature at the data block scale, the transmission direction feature at the traffic sequence scale, and the second behavioral feature at the data stream scale.

[0040] Specifically, the behavioral patterns of Tor traffic can be jointly modeled at three levels. Because Tor traffic exhibits highly homogeneous surface morphology (all cells are 512 bytes), packet length or total statistics alone cannot distinguish between normal and malicious behavior. By introducing three levels of granularity—data blocks, traffic sequences, and data streams—we can respectively characterize local micro-interactions, the rhythm of direction switching, and the overall session evolution, thereby uncovering discriminative behavioral features even without payload information.

[0041] For example, the first behavior feature at the data block scale is to extract local temporal behavior on a unit of two adjacent cells. For example, the time interval between consecutive cells, the number of direction changes (up→down or down→up), the burst interval (number of consecutive cells in the same direction), and the local density (number of cells per unit time) can be calculated. Local pattern features can also be extracted on a sliding window (e.g., 5 cells) using a one-dimensional convolutional neural network (1D-CNN).

[0042] Transmission direction characteristics at the flow sequence scale: The direction (uplink / downlink) of each cell in the entire sequence is encoded into a binary sequence (e.g., 1 represents uplink and 0 represents downlink). The direction entropy, direction switching frequency, and direction duration distribution are calculated by the direction sequence conversion mode (e.g., "1010" represents high-frequency switching and "111000" represents long-term unidirectional transmission) to form a directional behavior signature.

[0043] The second behavioral feature at the data flow scale is to perform global modeling of the complete session and extract macroscopic statistics such as session duration, total number of cells, uplink to downlink cell ratio, traffic symmetry (ratio of total uplink bytes to total downlink bytes), and periodicity (whether there are periodic cell transmissions at fixed intervals). Long Short-Term Memory (LSTM) networks are used to capture long-range dependencies.

[0044] Among them, the data block scale refers to the local behavior at the smallest transmission unit (Cell) level, reflecting the micro-rhythm of communication, such as packet intervals and abrupt changes in direction. Transmission direction characteristics refer to the interaction patterns of the communication flow between uplink (client → server) and downlink (server → client), and are a key indicator in Tor anonymous communication that distinguishes normal browsing (such as webpage loading) from malicious control (such as C2 command feedback). The data flow scale refers to the macro-level behavioral patterns at the complete session level, reflecting the overall structure and evolution trend of communication, such as session duration and traffic symmetry, and is used to identify long-term behavioral patterns.

[0045] Step S220: Construct training samples based on the first behavior feature, transmission direction feature, and second behavior feature of multiple traffic sequences respectively.

[0046] Specifically, the multi-scale features extracted in the previous step are integrated and structured to form a training sample set that can be used for supervised learning. Each sample consists of a set of multi-dimensional feature vectors, containing features extracted from three scales: data blocks, sequences, and data streams, and is accompanied by its category label (normal or malicious), providing a clear learning objective for the classification model. This step is a crucial transition from feature engineering to model training, ensuring that the input data possesses both rich behavioral expressiveness and conforms to the input specifications of machine learning models.

[0047] Step S230: Train the classification model using training samples to obtain the detection model.

[0048] The detection model can determine whether the Tor traffic data to be detected is malicious traffic based on the first behavioral characteristics, transmission direction characteristics, and second behavioral characteristics of the Tor traffic data to be detected.

[0049] Specifically, a classifier is trained using supervised learning to automatically identify whether the Tor traffic being tested is malicious. The input to the classification model is a feature vector generated from new traffic through the same multi-scale feature extraction process as the training phase, and the output is the probability of malicious activity or a class decision. This transforms manually defined behavioral rules into generalizable mathematical mappings, enabling the automatic identification of unknown malicious behavior.

[0050] In this embodiment, the problem of traditional feature extraction failure caused by the fixed cell structure of Tor traffic is solved by constructing standardized traffic sequences. A unified data structure enables subsequent models to stably handle Tor streams of arbitrary length, providing a reusable and comparable data foundation for multi-scale behavior modeling, significantly improving the reliability of feature extraction and the convergence efficiency of model training. Through three-scale joint modeling, behavior is comprehensively characterized from three dimensions: local actions, interaction patterns, and overall trajectory, enhancing the ability to distinguish behavior patterns and providing highly discriminative input features for subsequent classification. By unifying multi-scale features into structured training samples, the problems of isolated features and inability to collaboratively make decisions in traditional methods are solved. Single features are easily affected by noise, while the concatenation of multiple features forms complementarity, improving the model's tolerance to complex behaviors. Automatic identification of malicious traffic is achieved through model training, giving the model generalization capabilities. Even when faced with malicious traffic not present in the training set, it can effectively identify it through similar behavior patterns, improving the accuracy of malicious traffic identification. By using features at three scales, traffic is characterized from three dimensions: micro-interaction, directional pattern, and macro-evolution. This overcomes the one-sidedness of single-granularity features and thus achieves accurate identification of malicious traffic.

[0051] In one embodiment, such as Figure 3As shown, step S210 determines the feature data of multiple flow sequences at multiple different scales. This includes steps S300-S340:

[0052] Step S300: Extract the time information, location information, and direction information of multiple traffic sequences respectively.

[0053] The traffic sequence includes multiple data blocks. The time information includes the arrival time of the data blocks, the time interval between adjacent data blocks, and the timing information of the data blocks. The location information includes the position of the data blocks in the traffic sequence, and the direction information includes the transmission direction of the traffic sequence.

[0054] Specifically, three types of basic metadata closely related to communication behavior are extracted from the raw Tor traffic data as the input basis for subsequent multi-scale feature modeling. The Tor network uses a fixed-length 512-byte cell as the basic transmission unit to extract three types of information: time information, location information, and direction information. These information do not depend on the data content but are directly derived from the communication timing and interaction structure, belonging to behavioral-level features. This effectively avoids the feature homogenization problem caused by Tor encryption and the fixed cell structure.

[0055] For example, firstly, session-level reassembly is performed on the original network traffic data, sorting consecutive cells belonging to the same communication flow by timestamp to form a standardized traffic sequence. Each cell, as a data block in the sequence, records its arrival timestamp (accurate to the microsecond level), and calculates the time interval between adjacent cells to form a time series. Simultaneously, the absolute index (e.g., 1st, 2nd, etc.) or relative position (e.g., first 10%, middle 50%, last 10%) of each cell in the sequence is recorded as location information. Communication direction information is determined by identifying the transmission flow direction of each cell. Typically, based on the initial interaction direction between the source IP and destination IP, the entire flow is divided into uplink (client → server) or downlink (server → client) directions, and each cell inherits the direction marker of its respective flow.

[0056] Step S310: Construct a time embedding vector based on the time information of multiple traffic sequences.

[0057] The temporal embedding vector is used to characterize the temporal variation features of the data block.

[0058] Specifically, the extracted raw time information (such as arrival time and time interval) is transformed into a high-dimensional continuous vector representation, enabling the model to capture the dynamic evolution patterns of traffic behavior over time. Since the original timestamps are scalar values, directly inputting them into the model results in low learning efficiency due to inconsistent numerical scales, unclear periodicity, and difficulty in modeling nonlinear relationships. The introduction of time-embedded vectors solves the problems of sparsity, nonlinearity, and periodicity in representing time information, enabling the model to perceive the rhythmic changes, sudden patterns, and long-term trends of traffic.

[0059] Step S320: Construct a location embedding vector based on the location information of multiple traffic sequences.

[0060] The location embedding vector is used to characterize the location features of the data block.

[0061] Specifically, the relative or absolute position of each data block in the traffic sequence is transformed into a learnable vector representation to address the issue that cells at different positions in the sequence may have different behavioral semantics. In Tor communication, the cells at the beginning of the sequence may carry handshake or authentication information, the middle part is the main data transmission body, and the end may be connection closure or abnormal termination, and their behavioral patterns exhibit significant positional dependencies.

[0062] Step S330: Construct a direction embedding vector based on the direction information of multiple traffic sequences.

[0063] The orientation embedding vector is used to characterize the transmission direction features of the data block.

[0064] Specifically, the discrete attribute of communication direction (uplink or downlink) is transformed into a continuous vector representation to capture the asymmetric characteristics of bidirectional interaction in Tor traffic. In the Tor network, normal user behavior (such as browsing web pages) typically manifests as "a small number of uplink requests and a large number of downlink responses." Malicious communication (such as C2 command control) may exhibit abnormal patterns such as "high-frequency uplink heartbeats + low-frequency downlink commands" or "one-way data transmission."

[0065] Step S340: Based on the time embedding vector, position embedding vector, and orientation embedding vector, determine the feature data of multiple flow sequences at multiple different scales.

[0066] Specifically, the three types of embedding vectors generated in the first three steps are fused and layered to extract multi-level behavioral features at three scales: cell granularity, direction granularity, and flow granularity, constructing a comprehensive, complementary, and highly discriminative behavioral signature. Single-granularity features cannot fully describe complex communication behaviors, while multi-scale joint modeling can abstract layer by layer, achieving a complete characterization of behavior from micro-interactions to macro-structures.

[0067] In this embodiment, firstly, by extracting three types of non-content-based metadata—time, location, and direction—the technical bottleneck of traditional features failing due to fixed cell structures is bypassed. Secondly, by constructing three learnable dense vector representations—time embedding, location embedding, and direction embedding—the original discrete and disordered time-series signals are transformed into continuous spatial representations with semantic expressive capabilities, enabling the model to automatically learn the dynamic patterns and structural rules of communication behavior. Thirdly, through parallel feature extraction and fusion at three granularities, multi-level behavioral modeling from local interactions to overall trends is achieved, avoiding the one-sidedness of single-scale features. This results in a new feature expression paradigm that can effectively characterize behavioral differences even without content to analyze, improving the accuracy of malicious Tor traffic detection without relying on any payload decryption or packet length statistics.

[0068] In one embodiment, such as Figure 4 As shown, step S340 determines the feature data of multiple flow sequences at multiple different scales based on the time embedding vector, location embedding vector, and orientation embedding vector. This includes steps S400-S420:

[0069] Step S400: Determine the first behavioral feature of the data block scale based on the temporal variation features of the data block represented in the time embedding vector, the positional features of the data block represented in the position embedding vector, and the transmission direction features of the data block represented in the direction embedding vector.

[0070] Specifically, at the finest-grained data block level, behavior modeling is performed on each fixed-length Cell (data block) in the Tor network. Since each Cell in Tor traffic is a fixed-length structure of 512 bytes, traditional feature extraction methods that rely on packet length variations or payload differences fail. Therefore, by introducing embedding vectors in three dimensions—time, location, and orientation—the dynamic features of the Cell are reconstructed from a behavioral perspective, overcoming the representation bottleneck caused by the fixed length.

[0071] For example, a 1D convolutional neural network (CNN) or a gated recurrent unit (GRU) is used to process a continuous sequence of cells, capture the local temporal changes and orientation switching patterns between adjacent cells, and output the local behavioral features of each cell.

[0072] Step S410: Determine the transmission direction features of the flow sequence scale based on the transmission direction features of the flow sequence represented in the direction embedding vector.

[0073] Specifically, starting from the granularity of traffic sequences, without relying on the details of individual cells, we perform macroscopic modeling of the uplink and downlink direction sequences of the entire session or stream, identify the patterns, proportions, and rhythms of direction switching, and use this to capture the typical characteristics of malicious traffic in communication behavior, such as the directional pattern of botnets often exhibiting small instructions going uplink and large data being transmitted downlink.

[0074] For example, for a complete Tor stream, the direction markers of all its cells are extracted to form a direction sequence, such as [uplink, downlink, downlink, uplink, downlink, ...]. This sequence is then statistically analyzed and encoded: the ratio of the number of uplink cells to the number of downlink cells in the direction sequence is calculated; the number of direction switches (from uplink to downlink or vice versa) is counted; the longest duration of consecutive uplink / downlink cells is calculated; and the entire direction sequence is encoded using a direction embedding vector: the direction sequence is divided into fixed-length windows (e.g., 20 cells), a histogram is used to analyze the direction distribution within each window, and then the vector is compressed into a fixed-dimensional vector through a fully connected layer, serving as the transmission direction feature at the traffic sequence scale. This feature is independent of the cell's time and location information and directly reflects the interaction pattern at the stream level. For example, normal Tor browsing typically involves symmetrical uplink requests and downlink responses, while malicious traffic is often dominated by unidirectional or asymmetrical directions.

[0075] Step S420: Determine the second behavioral feature of the data stream scale based on the temporal variation features of the traffic sequence represented by the time embedding vector, the positional features of the traffic sequence represented by the position embedding vector, and the transmission direction features of the traffic sequence represented by the direction embedding vector.

[0076] Specifically, global behavior modeling is performed at the data flow granularity level, taking into account the time evolution, location distribution, and directional structure of the entire flow, capturing long-term behavioral trends and global structural characteristics, such as the duration of malicious traffic, behavioral stability, and phased patterns, to achieve a complete behavioral profile from local to global.

[0077] For example, for a complete Tor stream, the three vector sequences of temporal embedding, positional embedding, and orientation embedding are fed into a high-level neural network module for joint modeling:

[0078] Temporal embedding sequence: Input to Transformer encoder or LSTM to extract global temporal dependencies, such as whether burst intervals are stable and whether there are periodic reconnections;

[0079] Location embedding sequence: The importance of each location in the global behavior is calculated through an attention mechanism to identify behavioral abrupt points (such as a sudden large number of downlinks after the 50th cell).

[0080] Directional embedding sequence: Combined with temporal embedding, construct a directional-temporal joint evolution graph, such as whether uplink-long delay-downlink forms a fixed pattern.

[0081] The vectors from the three scales mentioned above are concatenated or fused using attention weighting and then input into a fully connected layer to generate a low-dimensional, high-semantic second behavioral feature vector. This vector represents the macroscopic behavioral structure of the entire stream; for example, short-term, high-frequency interactions with highly symmetrical directions represent normal browsing, while long-term, unidirectional, continuous, and directionless switching represents data outflow.

[0082] In this embodiment, at the data block (Cell) granularity, the first behavioral feature is generated by embedding time, location, and direction, which solves the problem of not being able to distinguish between the same byte content and different behavioral patterns; at the traffic sequence granularity, the transmission direction feature is extracted by relying solely on direction embedding, which identifies typical unidirectional, asymmetric, and long-term continuous directional patterns of malicious traffic; at the data stream granularity, the three types of embedding are fused to generate the second behavioral feature, which captures long-term evolution trends and global behavioral structures, and identifies advanced attack behaviors such as staged, periodic, and latent attacks.

[0083] In one embodiment, such as Figure 5 As shown, after constructing training samples based on the first behavior features, transmission direction features, and second behavior features of multiple traffic sequences in step S220, the method further includes: steps S500-S520:

[0084] Step S500: Use multiple different quality assessment models to evaluate the sample quality of each sample in the training samples, and obtain the quality scores output by the multiple different quality assessment models.

[0085] Among them, the quality assessment model has pre-learned the quality standards of the samples, and the detection methods of multiple different quality assessment models have different focuses.

[0086] Specifically, before each sample in the training sample set enters the subsequent processing flow, the system calls multiple anomaly detection models with different structures and complementary principles to perform independent quality assessments on each sample. Each model generates a corresponding quality score based on the normal sample distribution or high-quality sample features it has learned, which is used to measure whether the sample deviates from the typical behavior pattern of its category. These models have different evaluation perspectives; for example, some focus on local density anomalies, some focus on reconstruction errors, and some evaluate consistency boundaries, thus forming a multi-dimensional and redundant verification of sample quality.

[0087] For example, for each training sample, its latent feature representation is input into five pre-trained anomaly detection models, including Isolation Forest, Local Outlier Factor (LOF), One-Class Support Vector Machine (OC-SVM), Variational Autoencoder (VAE) anomaly detection module, and Masked Autoencoder for Distribution Estimation (MADE). Isolation Forest calculates the average number of cuts required to isolate a sample by randomly cutting the data space; fewer cuts indicate a more likely anomaly. LOF calculates the relative density deviation between a sample and its neighbors based on local density comparison; lower density indicates a higher degree of anomaly. OC-SVM learns a hyperplane boundary in the feature space that surrounds normal samples; samples falling outside the boundary are considered anomalies. VAE reconstructs input samples; if the reconstruction error is significantly higher than the average error of normal samples, it is considered low-quality. MADE estimates the probability density of a sample in the feature space through autoregression; lower density values ​​indicate a sample is further away from the distribution center. Each model outputs a normalized anomaly score (between 0 and 1, with higher scores indicating greater anomalies), which serves as the model's independent judgment of sample quality.

[0088] Each model outputs its corresponding anomaly score, density score, reconstruction error score, or consistency score, which are then fused. Let the i-th sample receive a score from the k-th model (one of the five models mentioned above). Then the ensemble quality score of this sample can be expressed as:

[0089] in, For the score fusion function, mean fusion, weighted mean fusion, median fusion, ranking fusion, or other robust fusion methods can be used. A higher quality score indicates that the sample is closer to the stable distribution region of its class, and is more suitable for classifier training.

[0090] Among them, Isolation Forest is an unsupervised anomaly detection algorithm based on the idea of ​​random partitioning. Its core assumption is that outliers are more easily isolated by random partitioning, while normal points require more partitioning to be separated.

[0091] Local Outlier Factor (LOF): A density-based anomaly detection method that quantifies the degree of outlier of a sample relative to its surrounding points by comparing the local density of the sample with that of its neighborhood. The sparser the density, the higher the LOF value.

[0092] Single-class support vector machine: a supervised learning method for anomaly detection that is trained using only normal samples. The goal is to learn a tight decision boundary that includes all normal samples and classifies samples that deviate from the boundary as anomalies.

[0093] Variational autoencoder: A probabilistic generative model that maps the input to a latent space through an encoder, and then the decoder reconstructs the input. Outlier samples are identified as low-quality samples because they cannot be reconstructed well and thus produce high reconstruction errors.

[0094] Masked Autoregressive Model: A density estimation model based on neural networks that uses masked connections to ensure that each input variable depends only on the variables preceding it, thereby constructing an accurate joint probability distribution for evaluating the likelihood of a sample.

[0095] Step S510: Determine the total score of each sample in the training samples based on the quality scores output by multiple different quality assessment models.

[0096] Specifically, after obtaining the independent scores of each sample under five different quality assessment models, the system merges these scores to calculate a comprehensive total score, which represents the overall quality level of the sample under the entire assessment system and is used to quantify its potential contribution to the training of the classification model.

[0097] For example, the five quality scores for each sample are aggregated using a weighted median fusion strategy. First, the scores of each model are normalized and weighted according to their historical validation performance. For instance, Isolation Forest has the highest accuracy in identifying boundary samples in historical experiments, so it is assigned a weight of 0.25; LOF is sensitive to density anomalies, so it is assigned a weight of 0.2; VAE is stable in responding to reconstruction distortion, so it is assigned a weight of 0.2; MADE has strong ability to capture distribution tails, so it is assigned a weight of 0.2; and OC-SVM is accurate in judging the overall boundary, so it is assigned a weight of 0.15. Then, the weighted scores are sorted in ascending order, and the median of the sorted sequence is taken as the total score for that sample. This method preserves the sorting information of the original scores while suppressing the interference of extreme outliers, making it more robust than the arithmetic mean. For example, if a sample scores [0.85, 0.72, 0.91, 0.68, 0.75] in five models, and then is weighted and sorted as [0.68×0.2, 0.72×0.2, 0.75×0.15, 0.85×0.25, 0.91×0.2], the median of the weighted scores is the total score. Each sample ultimately receives a total score between 0 and 1. A higher score indicates that the sample is closer to the typical distribution of its class and is more suitable as a high-quality training sample.

[0098] Step S520: Assign corresponding weights to each sample in the training samples based on the total score of each sample in the training samples.

[0099] The weights are positively correlated with the total score and are used to indicate the priority of samples that the classification model learns when training the classification model.

[0100] Specifically, the system converts the total score of each training sample into training weights according to a determined mapping function. The weight values ​​monotonically increase as the total score increases, which is used to dynamically adjust the contribution of each sample to the loss function during the classification model training process, so that high-scoring samples have a greater influence in parameter updates and the interference of low-scoring samples is suppressed.

[0101] For example, the quality score of the i-th sample can be used as a basis. Generate corresponding training weights And introduce it into the classification loss function:

[0102] in, For real labels, For the classifier output, This is the basic classification loss function. The higher the sample quality, the greater the corresponding weight, thus enabling the classifier to prioritize learning the effective information from high-quality samples. In other words, during backpropagation, the gradient contribution of high-weight samples is amplified, while the gradient of low-weight samples is suppressed, thereby guiding the model to prioritize learning high-confidence and highly representative samples.

[0103] In this embodiment, by introducing multiple quality assessment models with different assumptions and computational mechanisms, the system can identify noise, boundary samples, overfitted samples, and out-of-distribution samples in the training samples from multiple perspectives. A single model is susceptible to its own biases; for example, isolated forests are sensitive to high-dimensional sparse data, and OC-SVM is highly dependent on kernel function selection. Parallel evaluation of multiple models effectively mitigates the risk of misjudgment by a single model. This redundant evaluation mechanism improves the stability and robustness of sample quality judgment, avoiding the problem of overall evaluation inaccuracy due to the failure of a single model, and providing a reliable quality basis for subsequent weighted training.

[0104] In one embodiment, such as Figure 6 As shown, the method further includes steps S600-S610:

[0105] Step S600: Invoke the generator adversarial network to construct a synthetic sample of malicious traffic.

[0106] In this process, the generative adversarial network is trained in advance using malicious traffic data.

[0107] Specifically, the system invokes a Generative Adversarial Network (GAN) pre-trained using only real malicious Tor traffic samples during the training phase to generate synthetic samples that are highly consistent with real malicious traffic in the latent feature space. This network does not rely on the original packet content, packet length, or protocol features. Instead, it learns and reproduces the distribution structure of malicious traffic at the behavioral level based on the low-dimensional latent features obtained in the previous stage through multi-scale representation learning and autoencoder compression. Thus, it generates new samples with realistic behavioral semantics without revealing the original data.

[0108] For example, before training, all Tor traffic (including normal and malicious traffic) has been transformed into a unified-dimensional latent feature vector through a multi-scale feature extraction module and an autoencoder compression module. This vector retains the behavioral discrimination information of the original traffic at the cell, direction, and flow granularities, while removing redundancy and noise. The system selects the latent feature vectors of all Tor traffic samples labeled as malicious in the training set as training data for the Generative Adversarial Network (GAN). The GAN consists of two sub-networks: a generator and a discriminator. The generator receives a random noise vector following a standard normal distribution as input and outputs a synthetic vector with the same latent feature dimension as the malicious traffic. The discriminator receives the latent features of real malicious samples or the synthetic samples output by the generator and outputs the probability that the sample is real or fake. During training, the generator aims to deceive the discriminator, making it unable to distinguish between synthetic and real samples; the discriminator aims to accurately distinguish between the two. Both update their parameters alternately through adversarial optimization. Training continued until the discriminator's accuracy in identifying synthetic samples stabilized at around 50%, indicating that the generator had sufficiently approximated the potential distribution of real malicious traffic. Finally, the generator output a new set of synthetic potential feature vectors as virtual samples of malicious traffic.

[0109] Among them, Generative Adversarial Network (GAN) is a deep learning architecture consisting of a generator and a discriminator. The two are trained adversarially so that the generator learns to generate samples that are highly similar to the distribution of real data.

[0110] In one or more alternative embodiments, multiple generative adversarial networks with different fitting feature distribution angles can be invoked to construct synthetic samples of malicious traffic. These synthetic samples are then added to the training samples to increase the amount of malicious traffic in the training samples.

[0111] Specifically, when constructing synthetic samples of malicious traffic, multiple generative adversarial networks (GANs) with different structures and complementary training objectives can be deployed and invoked in parallel. For example, a GAN that fits local distribution features, a GAN that fits global distribution features, and a GAN that fits nonlinear distribution features can be used. These three GANs learn the distribution patterns of potential features of malicious Tor traffic from three independent dimensions: microscopic local dynamics, macroscopic session structure, and high-dimensional nonlinear manifold, respectively, and each outputs synthetic samples with specific distribution attributes.

[0112] For example, the multiple generative adversarial networks include at least: a generative adversarial network that fits local distribution features, a generative adversarial network that fits global distribution features, and a generative adversarial network that fits nonlinear distribution features.

[0113] Among them, fitting local distribution features refers to the generative model focusing on learning the local statistical regularities and dynamic change patterns of data in a short time window or between adjacent elements, such as micro-behavioral features such as abrupt changes in the time interval between adjacent data blocks and frequent switching of communication directions.

[0114] The generator of a generative adversarial network (GAN) that fits local distribution features can employ a shallow fully connected network or a one-dimensional convolutional structure, with a short sequence of noise vectors as input. During training, the system extracts adjacent segments from the potential features of real malicious traffic, forcing the generator to learn only micro-dynamic patterns such as local temporal rhythms and the frequency of switching directions between adjacent cells. The discriminator of this network focuses on determining whether the generated segments are statistically consistent with the real local segments. This network is responsible for generating local behavioral variants such as high-frequency bursts and short-cycle interactions.

[0115] Fitting global distribution features means that the generative model focuses on learning the macroscopic statistical properties and long-term evolutionary trends of data throughout the entire session or long sequence, such as the overall structural features of total session duration, the proportion of dominant transmission directions, and behavioral stage division.

[0116] The generator of a generative adversarial network (GAN) that fits global distribution features can employ a Long Short-Term Memory (LSTM) network or a Transformer decoder architecture, with input being a noise sequence spanning the entire session length. During training, the system uses the latent features of real malicious traffic of the full length as the learning objective, requiring the generator to capture macroscopic structural attributes such as the overall session duration, the proportion of dominant transmission directions, and the evolution of staged behaviors. The network's discriminator evaluates the global statistical properties of the generated sequences, such as total session duration, average interval, and directional entropy. This network is responsible for generating global samples that conform to the characteristics of a typical malicious communication lifecycle.

[0117] Fitting nonlinear distribution features refers to generative models that focus on learning complex nonlinear manifold structures, decision boundary intersection regions, and multimodal mixed distributions in high-dimensional feature spaces. This breaks through the limitations of linear interpolation or simple probability distributions and captures high-order coupling relationships and complex mapping patterns between features.

[0118] The generator of a generative adversarial network (GAN) that fits nonlinear distribution features can employ a conditional Wasserstein GAN or a diffusion model structure, introducing manifold learning constraints and gradient penalty mechanisms. During the training phase, the system utilizes the complex topological structure of real malicious features in high-dimensional space, forcing the generator to learn nonlinear curved boundaries, class crossover regions, and multimodal mixed distributions in the feature space. The discriminator or value network of this network evaluates the density consistency and distribution continuity of the generated samples on the nonlinear manifold. This network is responsible for generating challenging samples located near the decision boundary between the normal and malicious classes, or in the transition zone between multiple malicious modes.

[0119] Step S610: Add the synthetic sample to the training sample to increase the sample size of malicious traffic in the training sample.

[0120] Specifically, the synthetic samples generated in the previous step are merged with the real malicious traffic samples in the original training set to increase the number of malicious traffic samples in the training samples, so that the proportion of malicious category samples is increased to a level that can support the effective learning of deep models.

[0121] In this embodiment, a generative adversarial network is invoked to construct synthetic samples of malicious traffic, and these synthetic samples are added to the training samples to increase the amount of malicious traffic, thereby increasing the amount of malicious traffic samples and enabling the model to better learn the characteristics of malicious traffic during subsequent training.

[0122] In one embodiment, such as Figure 7 As shown, step S610 involves adding synthetic samples to the training samples to increase the sample size of malicious traffic in the training samples. This includes steps S700-S720:

[0123] Step S700: Use multiple different quality assessment models to evaluate the sample quality of each synthetic sample, and obtain the quality scores output by the multiple different quality assessment models.

[0124] Step S710: Select qualified samples based on the quality score of the synthesized samples.

[0125] Specifically, after obtaining the independent scores of each synthetic sample under the five quality assessment models, the system filters all synthetic samples according to preset rules, retaining only those samples that are evaluated as high-quality by most quality assessment models as qualified samples for training. This process excludes low-quality synthetic samples caused by generator errors, training noise, or distribution shifts, ensuring that every sample added to the training set is representative of real malicious behavior.

[0126] Step S720: Add qualified samples to the training samples to increase the sample size of malicious traffic in the training samples.

[0127] Specifically, qualified synthetic samples that have passed quality screening will be merged with real malicious traffic samples in the original training set to construct a malicious training subset with increased quantity, controllable quality, and more complete distribution.

[0128] In this embodiment, firstly, a generative adversarial network generates a large number of synthetic samples based on real malicious traffic in the latent space. Secondly, multiple independent quality assessment models perform multi-dimensional cross-validation on each synthetic sample, outputting the degree to which it deviates from the real distribution. Thirdly, the system selects high-fidelity, low-anomaly qualified samples based on a comprehensive anomaly index. Finally, these qualified samples are merged with real samples to form a sufficient number of malicious training sets with controllable quality.

[0129] In one embodiment, such as Figure 8 As shown, after adding qualified samples to the training samples in step S720 to increase the sample size of malicious traffic in the training samples, the method further includes: steps S800-S810:

[0130] Step S800: Determine the ratio between the first sample size of normal traffic and the second sample size of malicious traffic in the training samples.

[0131] Specifically, after the training sample set is constructed, the system first counts the total number of normal Tor traffic samples and the total number of malicious Tor traffic samples in the current training set, and calculates the original ratio between the two to clarify the degree of imbalance in the current data distribution. This ratio serves as the benchmark for subsequent sample adjustments, used to determine whether intervention is needed and the intensity of such intervention.

[0132] Step S810: Adjust the first sample size of normal traffic and the second sample size of malicious traffic in the training samples according to the ratio so that the ratio reaches the preset balanced ratio.

[0133] Specifically, after obtaining the original sample ratio, the system adjusts the training set according to a preset balanced ratio target. By reducing majority class samples or increasing minority class samples, the ratio of normal traffic to malicious traffic samples is adjusted from an extremely imbalanced state to a more balanced state that is conducive to model learning. This adjustment process does not change the feature representation or label semantics of the samples; it only optimizes the training distribution through quantity control.

[0134] In this embodiment, the system first accurately identifies the imbalanced sample state by statistically analyzing the original sample counts of normal and malicious traffic. Secondly, based on a preset target ratio, the system selectively reduces the majority class using a weighted downsampling method, while retaining all quality-filtered minority class samples, thus achieving proactive optimization of the training distribution.

[0135] In one embodiment, such as Figure 9 As shown, the method further includes steps S900-S920:

[0136] Step S900: Obtain the Tor traffic data to be detected and construct a standardized traffic sequence from the Tor traffic data to be detected.

[0137] Specifically, the system collects raw Tor communication data from network links, mirror ports, traffic probes, or log systems, reassembles it at the session or stream granularity, and organizes continuous communication behavior into a time-sequential, structurally uniform traffic sequence, which serves as standardized input for subsequent feature extraction and detection. This process does not rely on decrypting the communication content; it only utilizes the communication timing and structural information to ensure effective analysis even in a Tor encrypted environment.

[0138] Step S910: Determine the feature data of the Tor traffic data to be detected at multiple different scales, and use them as the test data.

[0139] Specifically, the system extracts behavioral features of the traffic to be detected at three levels—Cell granularity, direction granularity, and flow granularity—based on standardized traffic sequences and using a multi-scale representation learning mechanism that is completely consistent with the training phase. These features are then compressed into a unified low-dimensional latent feature vector by an autoencoder, forming the final test data, which serves as the basis for inputting into the detection model.

[0140] Step S920: Input the data to be tested into the detection model to obtain the detection result.

[0141] The detection results include whether the Tor traffic data to be detected is malicious traffic. The detection results may also include the category or risk level of the malicious traffic, the corresponding classification score or confidence level, and anomaly alerts for suspected unknown attack traffic.

[0142] Specifically, the system inputs the potential feature vector to be tested generated in the previous step into the trained classification model, which then outputs the final judgment result to determine whether the traffic belongs to malicious Tor traffic. The system can also output confidence level or risk level to achieve automated identification of unknown traffic.

[0143] In this embodiment, the system first extracts and standardizes the original Tor traffic into a time series, achieving a lossless transformation from raw data to behavioral structure. Second, the system reuses the multi-scale feature extraction and latent space compression mechanism from the training phase to construct test data that is completely aligned with the training, ensuring semantic consistency of features. Finally, the system is input into the converged classification model and outputs a clear result for determining malicious traffic.

[0144] In one embodiment, such as Figure 10 As shown, the method further includes steps S1000-S1010:

[0145] Step S1000: Align the first behavior feature, transmission direction feature, and second behavior feature of the traffic sequence and then concatenate them to obtain a multi-scale behavior signature.

[0146] Specifically, the system extracts behavioral features from three different granularities (cell level, direction level, and flow level), spatially aligns them according to their correspondence on the time axis or structural dimension, and then concatenates these feature vectors along the feature dimension to form a unified, high-dimensional, multi-dimensional fused multi-scale behavioral signature, which serves as the input basis for subsequent feature compression and classification. This signature fully preserves the behavioral information of flow at the micro, meso, and macro levels, avoiding the one-sidedness of single-scale features.

[0147] Step S1010: Input the multi-scale behavioral signature into the encoder, compress the high-dimensional features of the multi-scale behavioral signature to filter redundant features and interference noise, and obtain the potential features of the traffic sequence.

[0148] Specifically, the system inputs the high-dimensional, multi-scale behavioral signature generated in the previous step into a pre-trained encoder module, compressing it into a low-dimensional, compact, and highly semantic latent feature vector through nonlinear mapping. This process aims to remove redundant information, duplicate features, and noise interference from the behavioral signature, retaining only the key discriminative information that best distinguishes normal traffic from malicious traffic. The final result is a latent feature with a dimension much smaller than the original signature but extremely high information density, which serves as the final input to the detection model.

[0149] In this embodiment, the system first aligns and concatenates three heterogeneous features—cell-level behavior, direction-level interaction, and flow-level trend—in the time dimension to construct a multi-scale behavior signature containing three layers of semantics, achieving complete behavior modeling from local actions to overall intent. Secondly, the system inputs this high-dimensional signature into an encoder, compressing it into low-dimensional latent features through a reconstruction constraint mechanism. This process removes redundancy, suppresses noise, and focuses on discriminative information, forming a feature representation with high information density and semantic purity.

[0150] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0151] Figure 11 This is a structural block diagram of a device for generating a malicious traffic detection model according to an embodiment of this application; as shown below. Figure 11 As shown, it includes:

[0152] The traffic acquisition module 1101 is used to acquire multiple Tor traffic data and construct multiple standardized traffic sequences from the multiple Tor traffic data, wherein at least one of the multiple Tor traffic data is malicious traffic;

[0153] The feature determination module 1102 is used to determine the feature data of multiple traffic sequences at multiple different scales, wherein the feature data at multiple different scales includes a first behavioral feature at the data block scale, a transmission direction feature at the traffic sequence scale, and a second behavioral feature at the data stream scale.

[0154] The sample construction module 1103 is used to construct training samples based on the first behavior feature, transmission direction feature and second behavior feature of multiple traffic sequences respectively.

[0155] The training module 1104 is used to train the classification model using training samples to obtain a detection model. The detection model can determine whether the Tor traffic data to be detected is malicious traffic based on the first behavioral feature, transmission direction feature, and second behavioral feature of the Tor traffic data to be detected.

[0156] In an exemplary embodiment, the apparatus is further configured to extract time information, location information, and direction information of multiple traffic sequences, wherein the traffic sequence includes multiple data blocks, the time information includes the arrival time of the data blocks, the time interval between adjacent data blocks, and the temporal sequence information of the data blocks, the location information includes the position of the data blocks in the traffic sequence, and the direction information includes the transmission direction of the traffic sequence; construct a time embedding vector based on the time information of the multiple traffic sequences, wherein the time embedding vector is used to characterize the temporal variation characteristics of the data blocks; construct a location embedding vector based on the location information of the multiple traffic sequences, wherein the location embedding vector is used to characterize the location characteristics of the data blocks; construct a direction embedding vector based on the direction information of the multiple traffic sequences, wherein the direction embedding vector is used to characterize the transmission direction characteristics of the data blocks; and determine the feature data of the multiple traffic sequences at multiple different scales based on the time embedding vector, the location embedding vector, and the direction embedding vector.

[0157] In an exemplary embodiment, the above-described apparatus is further configured to determine a first behavioral feature of the data block scale based on the temporal variation features of the data block represented in the temporal embedding vector, the positional features of the data block represented in the positional embedding vector, and the transmission direction features of the data block represented in the directional embedding vector; determine a transmission direction feature of the traffic sequence scale based on the transmission direction features of the traffic sequence represented in the directional embedding vector; and determine a second behavioral feature of the data stream scale based on the temporal variation features of the traffic sequence represented in the temporal embedding vector, the positional features of the traffic sequence represented in the positional embedding vector, and the transmission direction features of the traffic sequence represented in the directional embedding vector.

[0158] In an exemplary embodiment, the apparatus is further configured to evaluate the sample quality of each sample in the training samples using multiple different quality assessment models, thereby obtaining quality scores output by the multiple different quality assessment models, wherein the quality assessment models have pre-learned the quality standards of the samples, and the multiple different quality assessment models have different focuses in their detection methods; determine the total score of each sample in the training samples based on the quality scores output by the multiple different quality assessment models; and assign a corresponding weight to each sample in the training samples based on the total score of each sample in the training samples, wherein the weight is positively correlated with the total score, and the weight is used to indicate the priority of the samples learned by the classification model when training the classification model.

[0159] In an exemplary embodiment, the above-described apparatus is further configured to invoke a generative adversarial network to construct synthetic samples of malicious traffic, wherein the generative adversarial network is trained in advance using malicious traffic data; and to add synthetic samples to the training samples to increase the sample size of malicious traffic in the training samples.

[0160] In an exemplary embodiment, the above-described apparatus is further configured to evaluate the sample quality of each synthetic sample using multiple different quality assessment models to obtain quality scores output by the multiple different quality assessment models respectively; select qualified samples based on the quality scores of the synthetic samples; and add qualified samples to the training samples to increase the sample size of malicious traffic in the training samples.

[0161] In an exemplary embodiment, the above-described apparatus is further configured to determine the ratio between a first sample size of normal traffic and a second sample size of malicious traffic in the training samples; and adjust the first sample size of normal traffic and the second sample size of malicious traffic in the training samples according to the ratio, so that the ratio reaches a preset equilibrium ratio.

[0162] In an exemplary embodiment, the above-described apparatus is further configured to acquire Tor traffic data to be detected and construct a standardized traffic sequence from the Tor traffic data to be detected; determine the feature data of the Tor traffic data to be detected at multiple different scales as test data; input the test data into a detection model to obtain a detection result, wherein the detection result includes whether the Tor traffic data to be detected is malicious traffic.

[0163] In an exemplary embodiment, the above-described apparatus is further configured to align and splice the first behavioral feature, transmission direction feature, and second behavioral feature of the traffic sequence to obtain a multi-scale behavioral signature; input the multi-scale behavioral signature into an encoder to compress the high-dimensional features of the multi-scale behavioral signature to filter redundant features and interference noise, thereby obtaining the potential features of the traffic sequence.

[0164] In one exemplary embodiment, the apparatus is further configured to invoke multiple generative adversarial networks with different fitting feature distribution angles to construct synthetic samples of malicious traffic. These synthetic samples are then added to the training samples to increase the sample size of malicious traffic in the training samples.

[0165] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0166] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0167] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when run.

[0168] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0169] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0170] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0171] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0172] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0173] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0174] The embodiments described herein also provide a computer program that includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in any of the above method embodiments.

[0175] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing systems. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage system for execution by the computing system. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0176] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for generating a malicious traffic detection model, characterized in that, include: Multiple Tor traffic data points are acquired, and the multiple Tor traffic data points are respectively constructed into multiple standardized traffic sequences, wherein at least one of the multiple Tor traffic data points is malicious traffic; Determine the feature data of multiple traffic sequences at multiple different scales, wherein the feature data at multiple different scales includes a first behavioral feature at the data block scale, a transmission direction feature at the traffic sequence scale, and a second behavioral feature at the data stream scale; Training samples are constructed based on the first behavioral feature, the transmission direction feature, and the second behavioral feature of the multiple traffic sequences, respectively. The classification model is trained using the training samples to obtain a detection model. The detection model can determine whether the Tor traffic data to be detected is malicious traffic based on the first behavioral feature, transmission direction feature, and second behavioral feature of the Tor traffic data to be detected.

2. The method for generating a malicious traffic detection model according to claim 1, characterized in that, The determination of the feature data of the multiple flow sequences at multiple different scales includes: The time information, location information, and direction information of the multiple traffic sequences are extracted respectively. The traffic sequence includes multiple data blocks. The time information includes the arrival time of the data blocks, the time interval between adjacent data blocks, and the time sequence information of the data blocks. The location information includes the position of the data blocks in the traffic sequence. The direction information includes the transmission direction of the traffic sequence. A time embedding vector is constructed based on the time information of the multiple traffic sequences, wherein the time embedding vector is used to characterize the temporal variation features of the data block; A location embedding vector is constructed based on the location information of the multiple traffic sequences, wherein the location embedding vector is used to characterize the location features of the data block; A direction embedding vector is constructed based on the direction information of the multiple traffic sequences, wherein the direction embedding vector is used to characterize the transmission direction features of the data block; Based on the time embedding vector, the location embedding vector, and the direction embedding vector, the feature data of the multiple flow sequences at multiple different scales are determined.

3. The method for generating a malicious traffic detection model according to claim 2, characterized in that, The step of determining the feature data of the multiple flow sequences at multiple different scales based on the time embedding vector, the location embedding vector, and the orientation embedding vector includes: Based on the temporal variation characteristics of the data block represented by the time embedding vector, the positional characteristics of the data block represented by the position embedding vector, and the transmission direction characteristics of the data block represented by the direction embedding vector, a first behavioral feature of the data block scale is determined. Based on the transmission direction characteristics of the traffic sequence characterized in the direction embedding vector, the transmission direction characteristics of the traffic sequence scale are determined. The second behavioral feature of the data stream scale is determined based on the temporal variation characteristics of the traffic sequence represented in the temporal embedding vector, the positional characteristics of the traffic sequence represented in the positional embedding vector, and the transmission direction characteristics of the traffic sequence represented in the directional embedding vector.

4. The method for generating a malicious traffic detection model according to any one of claims 1-3, characterized in that, After constructing training samples based on the first behavioral feature, the transmission direction feature, and the second behavioral feature of the multiple traffic sequences, the method further includes: The quality of each sample in the training samples is evaluated using multiple different quality assessment models, and the quality scores output by the multiple different quality assessment models are obtained respectively. The total score of each sample in the training samples is determined based on the quality scores output by the multiple different quality assessment models. Based on the total score of each sample in the training samples, a corresponding weight is assigned to each sample in the training samples, wherein the magnitude of the weight is positively correlated with the total score, and the weight is used to indicate the priority of the samples learned by the classification model when training the classification model.

5. The method for generating a malicious traffic detection model according to any one of claims 1-3, characterized in that, The method further includes: A generative adversarial network is invoked to construct synthetic samples of malicious traffic, wherein the generative adversarial network is trained in advance using malicious traffic data; The synthetic sample is added to the training sample to increase the sample size of malicious traffic in the training sample.

6. The method for generating a malicious traffic detection model according to claim 5, characterized in that, Adding the synthetic sample to the training sample to increase the sample size of malicious traffic in the training sample includes: The quality of each synthetic sample is evaluated using multiple different quality assessment models, and the quality scores output by the multiple different quality assessment models are obtained respectively. Based on the quality score of the synthesized samples, qualified samples are selected; The qualified samples are added to the training samples to increase the sample size of malicious traffic in the training samples.

7. The method for generating a malicious traffic detection model according to claim 5, characterized in that, Adding the synthetic sample to the training sample to increase the sample size of malicious traffic in the training sample includes: Multiple generative adversarial networks with different fitting feature distribution angles are invoked to construct synthetic samples of the malicious traffic; The synthetic sample is added to the training sample to increase the sample size of malicious traffic in the training sample.

8. The method for generating a malicious traffic detection model according to claim 5, characterized in that, After adding the synthetic sample to the training sample to amplify the sample size of malicious traffic in the training sample, the method further includes: Determine the ratio between the first sample size of normal traffic and the second sample size of malicious traffic in the training samples; The first sample size of normal traffic and the second sample size of malicious traffic in the training samples are adjusted according to the ratio so that the ratio reaches a preset equilibrium ratio.

9. The method for generating a malicious traffic detection model according to any one of claims 1-3, characterized in that, The method further includes: Acquire the Tor traffic data to be detected, and construct a standardized traffic sequence from the Tor traffic data to be detected; The feature data of the Tor traffic data to be detected at multiple different scales are determined as the data to be tested; The test data is input into the detection model to obtain the detection result, wherein the detection result includes whether the Tor traffic data to be detected is malicious traffic.

10. The method for generating a malicious traffic detection model according to any one of claims 1-3, characterized in that, The method further includes: The first behavioral feature, the transmission direction feature, and the second behavioral feature of the traffic sequence are aligned and then concatenated to obtain a multi-scale behavioral signature. The multi-scale behavioral signature is input into the encoder, and the high-dimensional features of the multi-scale behavioral signature are compressed to obtain the latent features of the traffic sequence.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the steps of the method described in any one of claims 1 to 10.

12. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to perform the steps of the method described in any one of claims 1 to 10 through the computer program.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 10.

Images