Network anomaly detection method, device, electronic device and storage medium

Abstract

The present application discloses a network anomaly detection method, device, electronic device and storage medium, wherein the method includes: collecting network traffic data at the entrance of a network node, and performing flow-level aggregation and feature extraction on the network traffic data to obtain data to be labeled and unlabeled data according to a preset ratio, and obtaining labeled data by manually labeling and human-machine assisted labeling of the data to be labeled; preprocessing the labeled data and the unlabeled data to obtain labeled samples and unlabeled samples; using the labeled samples and the unlabeled samples for joint training to generate a semi-supervised network anomaly detection model; using the semi-supervised network anomaly detection model to detect and analyze the traffic data to be tested, and identify the abnormal results of the traffic data to be tested. The embodiments of the present application can reduce the dependence on labeled data in the network traffic, avoid the problem of imbalance of normal and abnormal category samples in the network attack detection training data, detect and discover potential unknown network attacks, and realize robust and effective network intrusion detection based on flow-level representation features.

Description

Technical Field

[0001] The present application relates to the field of computer network security technology, and in particular to a network anomaly detection method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of global information technology, networks are playing an increasingly important role in our daily lives, studies, and work. However, this has also brought with it the ubiquitous nature of cyberattacks, which has led to a growing concern for network security. Network traffic-based intrusion detection technology has been gaining attention in the network security field due to its strong detection capabilities, wide application range, and timely response. Furthermore, network anomaly detection, based on network traffic, is an important intrusion detection technology. By monitoring the operating status of network systems to detect various attack attempts, attack behaviors, or attack results, it can quickly and effectively detect various new intrusion behaviors. This is crucial for ensuring network system security and has become a key step in identifying network security incidents.

[0003] In network anomaly detection, supervised learning-based anomaly detection algorithms typically require a large amount of labeled data, consuming significant human and material resources. Unsupervised learning methods, on the other hand, suffer from low accuracy. Therefore, semi-supervised learning methods have gained widespread attention in the industry. Depending on the type of training data used, semi-supervised network anomaly detection can be categorized into two types: those providing only a large amount of labeled normal data, but no abnormal data, and those providing a small amount of labeled normal and abnormal data, along with a large amount of unlabeled data suitable for unsupervised learning. In the semi-supervised scenario, where only normal data is provided, anomaly detection algorithms often use unsupervised learning methods to model normal samples and learn their behavioral patterns. For samples to be tested, the difference between the behavioral patterns of the samples to be tested and those of normal samples is evaluated. If the difference is significant, the samples are classified as outliers. In the semi-supervised scenario, where a small number of labeled samples and a large number of unlabeled samples are provided, anomaly detection algorithms often use semi-supervised methods. These algorithms learn feature representations of samples through unsupervised learning on unlabeled samples. They then fine-tune the final anomaly detection classification model through supervised learning on a small number of labeled samples generated through manual or machine-assisted annotation.

[0004] Compared to anomaly detection in other fields, network traffic-based anomaly detection algorithms face three major challenges: First, there is a lack of labeled traffic data, as labeling network traffic data is expensive and difficult to do manually in large quantities. Second, there is an imbalance in traffic categories. Generally speaking, the amount of normal traffic far outnumbers attack samples. This extreme imbalance between normal and abnormal data makes it difficult to train algorithms. Finally, there is the problem of unknown attacks: in real-world scenarios, many types of network attacks that were not labeled during training may appear. Therefore, related technologies require further improvement.

[0005] Application Contents

[0006] The present application provides a network anomaly detection method, device, electronic device and storage medium to solve technical problems existing in related technologies, such as lack of marked traffic data, imbalanced traffic category data, and unknown attack problems.

[0007] The first aspect of the present application provides a network anomaly detection method, comprising the following steps: collecting network traffic data at the entrance of a network node, and performing flow-level aggregation and feature extraction on the network traffic data to obtain data to be labeled and unlabeled data according to a preset ratio, wherein the data to be labeled is obtained by manual labeling and human-machine assisted labeling to obtain labeled data; preprocessing the labeled data and the unlabeled data to obtain labeled samples and unlabeled samples; using the labeled samples and the unlabeled samples to jointly train a detection model based on an autoencoder and confidence-assisted classification to generate a semi-supervised network anomaly detection model; using the semi-supervised network anomaly detection model to detect the traffic data to be tested, and identifying the abnormal results of the traffic data to be tested based on the output result analysis of the semi-supervised network anomaly detection model.

[0008] Optionally, in one embodiment of the present application, the flow-level aggregation and feature extraction of the network traffic data includes: aggregating the traffic data into multiple bidirectional flows at preset time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>; performing feature extraction on the aggregated bidirectional flows to obtain the characteristics of the aggregated traffic, so as to obtain the data to be marked and the unmarked data according to a preset ratio, and the data to be marked is obtained by manual labeling and human-machine assisted labeling to obtain marked data.

[0009] Optionally, in one embodiment of the present application, the detection model based on the autoencoder and confidence-assisted classification is jointly trained using the labeled samples and the unlabeled samples to generate a semi-supervised network anomaly detection model, including: obtaining a first embedding representation using the encoder of the autoencoder according to any batch of samples in the labeled samples; evaluating the confidence score of the first embedding representation using a confidence assessment module and calculating the confidence loss; calculating the classification probability of the first embedding representation using a classifier, and correcting the classification probability using the confidence score, and calculating the loss value of the classifier using a focal loss function; calculating the comprehensive loss of the labeled samples, updating the encoder of the autoencoder, the confidence assessment module and the classifier; obtaining a second embedding representation using the encoder of the autoencoder according to any batch of samples in the unlabeled samples; decoding using the decoder of the autoencoder according to the second embedding representation; calculating the reconstruction loss of the unlabeled samples, and updating the encoder and decoder of the autoencoder; and judging whether the iteration round is reached, wherein if so, the training is terminated, otherwise the iterative execution is continued until the iteration round is reached.

[0010] Optionally, in one embodiment of the present application, the use of the semi-supervised network anomaly detection model to detect and analyze the traffic data to be tested includes: inputting a test sample of the traffic to be tested, and obtaining a test embedding representation by the updated encoder; obtaining a test decoding by the updated decoder according to the test embedding representation, and calculating the reconstruction loss of the test sample; evaluating the test confidence score of the test embedding representation by the updated confidence evaluation module; calculating the classification probability of the test embedding representation by the classifier; obtaining an anomaly score based on the reconstruction loss, test confidence score, and classification probability of the test sample; if the anomaly score exceeds a preset threshold, it is determined to be abnormal, otherwise it is determined to be normal.

[0011] Optionally, in one embodiment of the present application, the preprocessing of the labeled data and the unlabeled data to obtain the labeled samples and the unlabeled samples includes: performing unreasonable deletion operations, redundant data screening operations, feature encoding operations and / or feature normalization operations on the labeled data and the unlabeled data, respectively, to obtain the labeled samples and the unlabeled samples.

[0012] A second aspect of the present application provides a network anomaly detection device, including: an acquisition module for collecting network traffic data at the entrance of a network node, and performing flow-level aggregation and feature extraction on the network traffic data to obtain data to be labeled and unlabeled data according to a preset ratio, wherein the data to be labeled is obtained by manual labeling and human-machine assisted labeling; a processing module for preprocessing the labeled data and unlabeled data to obtain labeled samples and unlabeled samples; a training module for using the labeled samples and the unlabeled samples to jointly train a detection model based on an autoencoder and confidence-assisted classification to generate a semi-supervised network anomaly detection model; a detection module for using the semi-supervised network anomaly detection model to detect the traffic data to be tested, and identifying the anomaly results of the traffic data to be tested based on the output result analysis of the semi-supervised network anomaly detection model.

[0013] Optionally, in one embodiment of the present application, the acquisition module includes: an aggregation unit, used to aggregate the traffic data into multiple bidirectional flows at preset time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>; an acquisition unit, used to perform feature extraction on the aggregated bidirectional flows to obtain the features of the aggregated traffic, so as to obtain the data to be marked and the unmarked data according to a preset ratio, and the data to be marked is obtained by manual labeling and human-machine assisted labeling to obtain marked data.

[0014] Optionally, in one embodiment of the present application, the processing module is further used to perform unreasonable deletion operations, redundant data screening operations, feature encoding operations and / or feature normalization operations on the labeled data and the unlabeled data, respectively, to obtain the labeled samples and the unlabeled samples.

[0015] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program and a learning model stored in the memory and executable on the processor, wherein the processor executes the program and model to implement the network anomaly detection method as described in the above embodiment.

[0016] The fourth aspect of the present application provides a computer-readable storage medium on which a computer program and a learning model are stored. The program and model are executed by a processor to implement the network anomaly detection method as described in the above embodiment.

[0017] The semi-supervised network anomaly detection model is jointly trained using an autoencoder module, a confidence assessment module, and a classifier, using both unlabeled and labeled samples. Unlabeled samples are used to train the autoencoder's encoder and decoder, while labeled samples are used to train the autoencoder's encoder, confidence assessment module, and classifier. This approach uses a joint discrimination method to detect both known and unknown network traffic types in the training set and identify anomalies in the network traffic. This approach addresses technical issues such as a lack of labeled traffic data, an imbalance in data between normal and abnormal traffic types, and the problem of unknown attacks, which are common in related technologies.

[0018] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0020] Figure 1 A flowchart of a network anomaly detection method provided according to an embodiment of the present application; Figure 2 This is a flow chart of a network anomaly detection method according to one embodiment of the present application;

[0021] Figure 3 A logical diagram of a network anomaly detection method according to an embodiment of the present application;

[0022] Figure 4 Schematic diagram of a network anomaly detection method according to an embodiment of the present application;

[0023] Figure 5 This is a flowchart of joint training according to one embodiment of the present application;

[0024] Figure 6 This is a flowchart of joint discrimination according to one embodiment of the present application;

[0025] Figure 7 is an example diagram of a network anomaly detection device according to an embodiment of the present application;

[0026] Figure 8 A schematic diagram of the structure of an electronic device provided in an application embodiment.

[0027] Description of reference numerals:

[0028] 10-network anomaly detection device; 100-acquisition module, 200-processing module, 300-training module and 400-detection module; 801-memory, 802-processor and 803-communication interface. DETAILED DESCRIPTION

[0029] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0030] The following describes the network anomaly detection method, device, electronic device and storage medium of the embodiment of the present application with reference to the accompanying drawings. In response to the technical problems of the lack of labeled traffic data, imbalance of normal and abnormal traffic category data, and unknown attack problems existing in the related technologies mentioned in the background technology center above, the present application provides a network anomaly detection method. In this method, an automatic encoder module, a confidence assessment module and a classifier are used, and unlabeled samples and labeled samples are used to jointly train a semi-supervised network anomaly detection model, wherein the unlabeled samples are used to train the encoder and decoder of the automatic encoder, and the labeled samples are used to train the encoder, confidence assessment module and classifier of the automatic encoder, so as to detect the known types in the training set and the unknown network traffic in the training set by means of joint discrimination, and judge the abnormality of the network traffic. As a result, the technical problems of the lack of labeled traffic data, imbalance of normal and abnormal traffic category data, and unknown attack problems existing in the related technologies are solved.

[0031] Specifically, Figure 1 A flowchart of a network anomaly detection method provided in an embodiment of the present application.

[0032] like Figure 1 As shown, the network anomaly detection method includes the following steps:

[0033] In step S101, network traffic data at the entrance of the network node is collected, and flow-level aggregation and feature extraction are performed on the network traffic data to obtain data to be labeled and unlabeled data according to a preset ratio. The data to be labeled is obtained through manual labeling and human-machine assisted labeling to obtain labeled data.

[0034] It is understandable that if Figure 2 As shown, the embodiment of the present application first collects the network traffic data at the entrance of the network node, and performs flow-level aggregation and feature extraction on the collected data, and divides the traffic data into data to be labeled and unlabeled data according to a certain ratio set by the experiment. The data to be labeled is obtained by manual labeling and human-machine assisted labeling.

[0035] Optionally, in one embodiment of the present application, flow-level aggregation and feature extraction are performed on network traffic data, including: aggregating the traffic data into multiple bidirectional flows at preset time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>; performing feature extraction on the aggregated bidirectional flows to obtain features of the aggregated traffic, so as to obtain data to be marked and unmarked data in a preset ratio, and obtaining marked data by manual labeling and human-machine assisted labeling of the data to be marked.

[0036] Specifically, the network traffic data at the entrance of the network node is collected, and the collected original traffic data is aggregated into multiple bidirectional flows at a certain time interval based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>. Secondly, the characteristics of the aggregated traffic are extracted. Finally, the traffic is divided into labeled data and unlabeled data according to a preset ratio. The labeled data is obtained through manual labeling and human-machine assisted labeling.

[0037] In step S102 , labeled data and unlabeled data are preprocessed to obtain labeled samples and unlabeled samples.

[0038] That is to say, Figure 2 As shown, the traffic data is preprocessed to obtain labeled samples and unlabeled samples.

[0039] Optionally, in one embodiment of the present application, labeled data and unlabeled data are preprocessed to obtain labeled samples and unlabeled samples, including: performing unreasonable deletion operations, redundant data screening operations, feature encoding operations and / or feature normalization operations on the labeled data and unlabeled data, respectively, to obtain labeled samples and unlabeled samples.

[0040] Specifically, labeled and unlabeled data are preprocessed according to the principles of accuracy, completeness, consistency, timeliness, credibility, and interpretability of data quality, including but not limited to deleting unreasonable and redundant data, feature encoding, and feature normalization to obtain labeled and unlabeled samples.

[0041] It should be noted that deleting unreasonable and redundant data primarily involves removing records with null values, records with values ​​outside the numerical range, and records with identical attribute values. Furthermore, feature encoding primarily encodes non-numeric data in feature vectors as numeric data, while also encoding labels in labeled data as numeric data. Furthermore, feature normalization is performed to avoid dependency on the chosen feature measurement unit, primarily targeting different value ranges for different attributes, such as using min-max normalization.

[0042] In step S103, the labeled samples and the unlabeled samples are used to jointly train a detection model based on an autoencoder and confidence-assisted classification to generate a semi-supervised network anomaly detection model.

[0043] During the actual implementation process, the embodiment of the present application constructs a semi-supervised network anomaly detection model based on an autoencoder, a confidence assessment module, and a classifier, and uses labeled samples and unlabeled samples for joint training.

[0044] Optionally, in one embodiment of the present application, a detection model based on an autoencoder and confidence-assisted classification is jointly trained using labeled samples and unlabeled samples to generate a semi-supervised network anomaly detection model, including: obtaining a first embedding representation based on the encoder used for any batch of samples in the labeled samples; using a confidence assessment module to evaluate the confidence score of the first embedding representation and calculate the confidence loss; using a classifier to calculate the classification probability of the first embedding representation, and using the confidence score to correct the classification probability, and using a focal loss function to calculate the loss value of the classifier; calculating the comprehensive loss of the labeled samples, updating the encoder, confidence assessment module and classifier of the autoencoder; obtaining a second embedding representation based on any batch of samples in the unlabeled samples using the encoder of the autoencoder; decoding using the decoder of the autoencoder based on the second embedding representation; calculating the reconstruction loss of the unlabeled samples, and updating the encoder and decoder of the autoencoder; judging whether the iteration round is reached, wherein if so, the training is terminated, otherwise the iterative execution is continued until the iteration round is reached.

[0045] For example, step S103 includes:

[0046] Step S1031: Select a batch of labeled samples x l , then the encoder f using the autoencoder will have labeled batch samples x l Encoded as embedding representation h l .

[0047] Step S1032: Use the confidence evaluation module to evaluate the embedded representation h l The confidence score c = cof(h l ), and calculate the confidence loss as

[0048] Step S1033: Use the classifier to calculate the embedding representation h l The classification probability p = cls(h l ), and use the confidence score to correct the classification probability p to p', Then the classifier loss is calculated using the focal loss function (Focalloss) as Where Focal loss is FL(pt )=-α(1-p t ) γ log(p t ).

[0049] Step S1034: Calculate the comprehensive loss L of the labeled samples cls +λL cof ,The encoder of the autoencoder is updated according to the comprehensive loss, the confidence assessment module, and the classifier.

[0050] Step S1035: Select a batch of unlabeled samples x u , use the autoencoder encoder f to transform the unlabeled batch samples x u Encoded as embedding representation h u .

[0051] Step S1036: Use the decoder g of the autoencoder to embed the representation h u Decoded as x u,rec .

[0052] Step S1037: Calculate the reconstruction loss as L rec =ul(x u,rec ,x u ), and update the encoder and decoder of the autoencoder according to the reconstruction loss.

[0053] Step S1038: Determine whether the iteration round has been reached. If so, end the training; otherwise, jump to step S1031 and continue the execution.

[0054] In step S104, the semi-supervised network anomaly detection model is used to detect and analyze the traffic data to be measured, and anomaly results of the traffic data to be measured are identified according to the output results of the semi-supervised network anomaly detection model.

[0055] It is understandable that the above-trained semi-supervised network anomaly detection model is used to perform anomaly detection and analysis on the measured traffic data based on the joint evaluation method.

[0056] Optionally, in one embodiment of the present application, a semi-supervised network anomaly detection model is used to detect and analyze the traffic data to be tested, including: inputting a test sample of the traffic to be tested, and obtaining a test embedding representation by the updated encoder; obtaining a test decoding by the updated decoder according to the test embedding representation, and calculating the reconstruction loss of the test sample; evaluating the test confidence score of the test embedding representation by the updated confidence evaluation module; calculating the classification probability of the test embedding representation by the classifier; obtaining an anomaly score according to the reconstruction loss, the test confidence score, and the classification probability of the test sample; if the anomaly score exceeds a preset threshold, it is determined to be abnormal, otherwise it is determined to be normal.

[0057] For example, step S104 includes:

[0058] Step S1041: Input a sample x to be tested, and use an encoder f to encode the sample x into an embedded representation h.

[0059] Step S1042: Use decoder g to decode the embedded representation h into x rec , calculate the reconstruction loss as L rec =l(x rec ,x).

[0060] Step S1043: Use the confidence evaluation module to evaluate the embedded representation h l The confidence score c = cof(h).

[0061] Step S1044: Use the classifier to calculate the embedding representation h l The classification probability p=cls(h).

[0062] Step S1045: Combine the reconstruction loss, confidence score, and classification probability into an abnormality score output score = ηc × p-εc + L rec , η and ε are the weights of classification probability and confidence loss, respectively.

[0063] Step S1046: Determine whether the abnormality score exceeds the threshold, if so, output abnormal, otherwise output normal,

[0064] In summary, in the embodiments of the present application, an autoencoder is first used to learn the feature representation of unlabeled sample reconstruction. Since traffic data usually contains more normal samples, the reconstruction loss of abnormal samples based on the autoencoder is much higher than that of normal samples. Therefore, a confidence-assisted classification module is used to learn feature representations suitable for abnormal classification and abnormal probability modeling. The confidence-assisted classification module includes a confidence assessment module, a classifier, and an encoder shared with the autoencoder. The confidence assessment module models the confidence of the classifier's classification probability, assists in the training and anomaly assessment of the classifier. A high confidence is given for known traffic in the labeled data, and a low confidence is given for unknown traffic. The classifier models the abnormal probability of the sample, and at the same time, a focal loss function is used in training to deal with the imbalance problem of normal and abnormal traffic samples. When the confidence is high, the loss is calculated using the original prediction result, and when the confidence is low, the loss is calculated using the true label. Finally, the anomaly detection output module makes an anomaly judgment by combining the reconstruction loss, confidence, and classification probability of the decoder. The embodiments of the present application can adapt to real open network environments and better cope with challenges of network anomaly detection problems such as lack of labeled traffic data, imbalance of normal and abnormal traffic categories, and the existence of unknown attack categories.

[0065] The following examples are given for schematic illustration.

[0066] like Figure 2 As shown, the network anomaly detection method of the embodiment of the present application includes the following steps:

[0067] Step 1: Data collection, capturing and saving the traffic data at the network node entrance.

[0068] Step 2: Data aggregation: Aggregate the original traffic data into multiple bidirectional flows at certain time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>.

[0069] Step 3: Data feature extraction. The features of the aggregated traffic are extracted, and the features constitute a feature vector; the features include, 'flow ID', 'source IP', 'source port', 'destination IP', 'destination port', 'protocol', 'timestamp', 'flow duration', 'number of packets in the forward flow', 'number of packets in the reverse flow', 'minimum packet size in the forward flow', 'maximum packet size in the forward flow', 'average packet size in the forward flow', 'standard deviation of packet size in the forward flow', 'minimum packet size in the reverse flow', 'maximum packet size in the reverse flow', 'average packet size in the reverse flow', 'standard deviation of packet size in the reverse flow', 'number of bytes flowing per second', 'number of packets flowing per second', 'number of packets with ACK flags', 'average packet size', etc.

[0070] Step 4: Data preprocessing. The data preprocessing process includes deleting rows with empty values, encoding features, and deleting out-of-range values.

[0071] Step 5: Data encoding: For the input feature vector x, encode x into a traffic feature representation h = f(x).

[0072] Step 6: Calculate the abnormal probability, and calculate the encoded x f ,The anomaly probability is jointly calculated using the decoder, the confidence assessment module, and the,classification module.

[0073] Step 6.1: Reconstruction error calculation, decode the encoded h, and decode h into x rec =g(h), and calculate the reconstruction loss as l(x,x rec ).

[0074] Step 6.2: Confidence calculation: For the encoded h, use the confidence evaluation module to calculate the confidence cof(h).

[0075] Step 6.3: Classification probability calculation. For the encoded h, use the classification module to calculate the classification probability cls(h).

[0076] Step 6.4: Abnormal probability calculation: for the encoded h, using the above calculation results, the abnormal probability score = ηcof(h)×cls(h)-εcof(h)+l(x rec ,x), η and ε are the weights of classification probability and confidence loss respectively.

[0077] Step 6.5: Threshold comparison and result output. If the outlier value is greater than the threshold t, the output is abnormal, otherwise the output is normal.

[0078] like Figure 3 and Figure 4 As shown, the main structure of the embodiment of the present application includes the following six parts:

[0079] Input module part: The input module inputs the preprocessed feature vector into the subsequent modules.

[0080] Encoder: The encoder is a neural network consisting of three fully connected layers. The input layer has 77 neurons, the embedding layer has 10 neurons, and the middle hidden layer has 100 and 80 neurons, respectively. The encoder encodes the original input feature vector into a more compact feature representation suitable for classification.

[0081] Decoder: The decoder's structure is the opposite of the encoder's. The input layer has 10 neurons, the output layer has 77 neurons, and the intermediate hidden layers have 80 and 100 neurons, respectively. The encoder's function during training is to reconstruct the compact feature representation into the original input feature vector. During testing, the reconstruction error is used to aid in determining anomaly probability. A larger reconstruction error indicates a higher anomaly probability.

[0082] Confidence Assessment Module: The confidence assessment module is a neural network consisting of three fully connected layers. The input layer has 10 neurons, the output layer has 1 neuron, and the middle hidden layer has 10 neurons and 10 neurons, respectively. The confidence assessment module calculates the confidence score of each sample, maximizing the confidence level for known classes and assisting in determining the probability of anomalies for unknown classes. Furthermore, confidence is factored into classifier training. For high-confidence samples, the loss is calculated using the original classification prediction results, while for lower-confidence samples, the loss is calculated using the true label.

[0083] Classifier module: The classifier module is a neural network consisting of two fully connected layers. The input layer has 10 neurons, the output layer has 1 neuron, and the middle hidden layer has 10 neurons. The classifier module calculates the probability of abnormal classification of a sample, minimizing the abnormal loss of the sample during training, and outputs the abnormal probability of the sample during testing.

[0084] Anomaly detection output module: The output module integrates the output results of the decoder, confidence assessment module, and classifier module into an anomaly score output.

[0085] Figure 5 As shown, the joint training of the embodiment of the present application includes the following steps:

[0086] S1: Start.

[0087] S2: From the labeled samples, select a batch of labeled samples x l .

[0088] S3: The encoder f using the autoencoder will have labeled batch samples x l Encoded as embedding representation h l .

[0089] S4: Use the confidence evaluation module to evaluate the embedded representation h l The confidence score c = cof(h l ).

[0090] S5: Calculate the confidence loss as

[0091] S6: Use the classifier module to calculate the embedding representation h l The classification probability p = cls(h l ).

[0092] S7: Use the confidence score to correct the classification probability p to p',

[0093] S8: Use the focal loss function to calculate the classifier loss as Where Focal loss is FL(p t )=-α(1-p t ) γ log(p t ).

[0094] S9: Calculate the comprehensive loss L of the labeled samples cls +λL cof .

[0095] S10: Update the encoder of the autoencoder, the confidence assessment module, and the classifier module according to the comprehensive loss.

[0096] S11: From the unlabeled samples, select a batch of unlabeled samples x u .

[0097] S12: Use the autoencoder encoder f to convert the unlabeled batch samples x u Encoded as embedding representation hu .

[0098] S13: Use the decoder g of the autoencoder to embed the representation h u Decoded as x u,rec .

[0099] S14: Calculate the reconstruction loss as L rec =ul(x u,rec ,x u ).

[0100] S15: Update the encoder and decoder of the autoencoder according to the reconstruction loss.

[0101] S16: Determine whether the iteration round has been reached. If so, jump to the next step. If not, jump to step S2 and continue execution.

[0102] S17: End.

[0103] like Figure 6 As shown, the joint discrimination in the embodiment of the present application includes the following steps:

[0104] S1: Start.

[0105] S2: Input the sample x to be tested.

[0106] S3: Encode the sample x into an embedded representation h using encoder f.

[0107] S4: Use decoder g to decode the embedded representation h into x rec .

[0108] S5: Calculate the reconstruction loss as L rec =l(x rec ,x).

[0109] S6: Use the confidence evaluation module to evaluate the embedded representation h l The confidence score c = cof(h).

[0110] S7: Use the classifier module to calculate the embedding representation h l The classification probability p=cls(h).

[0111] S8: Combine the reconstruction loss, confidence score, and classification probability into anomaly score output score = ηc × p-εc + L rec .

[0112] S9: Determine whether the abnormality score exceeds the threshold t. If yes, execute S10 and skip S11. If not, skip S10 and execute S11.

[0113] S10: Output abnormality.

[0114] S11: Output is normal.

[0115] S12: End.

[0116] The network anomaly detection method proposed in the embodiments of this application utilizes an autoencoder module, a confidence assessment module, and a classifier, using both unlabeled and labeled samples to jointly train a semi-supervised network anomaly detection model. Unlabeled samples are used to train the autoencoder's encoder and decoder, while labeled samples are used to train the autoencoder's encoder, confidence assessment module, and classifier. This method uses a joint discrimination approach to detect known and unknown network traffic types in the training set and to determine network traffic anomalies. This solves technical issues in related technologies, such as a lack of labeled traffic data, an imbalance in data between normal and abnormal traffic categories, and the problem of unknown attacks.

[0117] Next, a network anomaly detection device according to an embodiment of the present application will be described with reference to the accompanying drawings.

[0118] Figure 7 Schematic diagram of a network anomaly detection device according to an embodiment of the present application.

[0119] like Figure 7 As shown, the network anomaly detection device 10 includes: a collection module 100 , a processing module 200 , a training module 300 and a detection module 400 .

[0120] Specifically, the collection module 100 is used to collect network traffic data at the entrance of the network node, and perform flow-level aggregation and feature extraction on the network traffic data to obtain the data to be labeled and the unlabeled data according to a preset ratio. The data to be labeled is obtained through manual labeling and human-machine assisted labeling to obtain labeled data.

[0121] The processing module 200 is used to pre-process the labeled data and the unlabeled data to obtain labeled samples and unlabeled samples.

[0122] The training module 300 is used to jointly train a detection model based on an autoencoder and confidence-assisted classification using labeled samples and unlabeled samples to generate a semi-supervised network anomaly detection model.

[0123] The detection module 400 is used to detect the traffic data to be tested using a semi-supervised network anomaly detection model, and identify anomalies of the traffic data to be tested based on the output results of the semi-supervised network anomaly detection model.

[0124] Optionally, in one embodiment of the present application, the acquisition module 100 includes: an aggregation unit and an acquisition unit.

[0125] The aggregation unit is used to aggregate the traffic data into multiple bidirectional flows at preset time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>.

[0126] The acquisition unit is used to extract features from the bidirectional flow obtained by aggregation to obtain the features of the aggregated flow, so as to obtain the data to be labeled and the unlabeled data. The data to be labeled is obtained by manual labeling and human-machine assisted labeling to obtain labeled data.

[0127] Optionally, in one embodiment of the present application, the processing module 200 is further used to perform unreasonable deletion operations, redundant data screening operations, feature encoding operations and / or feature normalization operations on the labeled data and the unlabeled data, respectively, to obtain labeled samples and unlabeled samples.

[0128] It should be noted that the above explanations of the network anomaly detection method embodiment are also applicable to the network anomaly detection device of this embodiment, and will not be repeated here.

[0129] The network anomaly detection device proposed in the embodiments of the present application utilizes an autoencoder module, a confidence assessment module, and a classifier, using both unlabeled and labeled samples to jointly train a semi-supervised network anomaly detection model. Unlabeled samples are used to train the autoencoder's encoder and decoder, while labeled samples are used to train the autoencoder's encoder, confidence assessment module, and classifier. This allows for joint discrimination of known and unknown network traffic types in the training set to determine network traffic anomalies. This solves technical issues in related technologies, such as a lack of labeled traffic data, imbalanced data between normal and abnormal traffic categories, and unknown attacks.

[0130] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0131] Memory 801 , processor 802 , and computer programs and learning models stored in the memory 801 and executable on the processor 802 .

[0132] When the processor 802 executes the program and the model, the network anomaly detection method provided in the above embodiment is implemented.

[0133] Furthermore, the electronic device further includes:

[0134] The communication interface 803 is used for communication between the memory 801 and the processor 802 .

[0135] The memory 801 is used to store computer programs and learning models that can be run on the processor 802.

[0136] The memory 801 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0137] If the memory 801, processor 802, and communication interface 803 are implemented independently, the communication interface 803, memory 801, and processor 802 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0138] Optionally, in a specific implementation, if the memory 801, the processor 802 and the communication interface 803 are integrated on a chip, the memory 801, the processor 802 and the communication interface 803 can communicate with each other through an internal interface.

[0139] Processor 802 may be a central processing unit (CPU), a deep learning processing architecture combining a central processing unit and multiple graphics processing units (GPUs), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0140] This embodiment also provides a computer-readable storage medium on which a computer program and a learning model are stored, characterized in that when the program and model are executed by a processor, the above-mentioned network anomaly detection method is implemented.

[0141] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0142] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0143] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0144] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, such as a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0145] Those skilled in the art will understand that all or part of the steps in the method for implementing the above-mentioned embodiment can be completed by instructing related hardware through programs and models, and the programs and models can be stored in a computer-readable storage medium. When the programs and models are executed, they include one of the steps of the method embodiment or a combination thereof.

Claims

1. A network anomaly detection method, characterized in that: The following steps are involved: Collect network traffic data at the entrance of the network node, and perform flow-level aggregation and feature extraction on the network traffic data to obtain labeled data and unlabeled data according to a preset ratio. The labeled data is obtained by manual labeling and human-machine assisted labeling. Preprocessing the labeled data and the unlabeled data to obtain labeled samples and unlabeled samples; Using the labeled samples and the unlabeled samples to jointly train a detection model based on an autoencoder and confidence-assisted classification to generate a semi-supervised network anomaly detection model; and Using the semi-supervised network anomaly detection model to detect the flow data to be measured, and identifying anomalies of the flow data to be measured based on the output results of the semi-supervised network anomaly detection model; The step of jointly training a detection model based on an autoencoder and confidence-assisted classification using the labeled samples and the unlabeled samples to generate a semi-supervised network anomaly detection model includes: Obtain a first embedding representation using an encoder of the autoencoder according to any batch of samples in the labeled samples; Evaluate the confidence score of the first embedding representation using a confidence evaluation module and calculate a confidence loss; Calculating a classification probability of the first embedding representation using a classifier, modifying the classification probability using the confidence score, and calculating a loss value of the classifier using a focal loss function; Calculating the comprehensive loss of the labeled samples, updating the encoder of the autoencoder, the confidence assessment module and the classifier; Obtain a second embedding representation using the encoder of the autoencoder according to any batch of samples in the unlabeled samples; Decoding the second embedding representation using a decoder of the autoencoder; Calculating the reconstruction loss of the unlabeled samples and updating the encoder and decoder of the autoencoder; Determine whether the iteration round is reached, where if so, end the training; otherwise, continue iterating until the iteration round is reached; The use of the semi-supervised network anomaly detection model to detect and analyze the traffic data to be measured includes: Input a sample to be tested of the flow to be tested, and obtain an embedded representation to be tested by the updated encoder; Obtaining a decoding to be tested using the updated decoder according to the embedded representation to be tested, and calculating the reconstruction loss of the sample to be tested; Evaluating a confidence score of the embedding representation to be tested using the updated confidence evaluation module; Calculating the classification probability of the embedded representation to be tested using a classifier; Obtaining an anomaly score according to the reconstruction loss, the confidence score, and the classification probability of the sample to be tested; If the abnormality score exceeds the preset threshold, it is determined to be abnormal, otherwise it is determined to be normal.

2. The method according to claim 1, characterized in that The performing flow-level aggregation and feature extraction on the network traffic data includes: Aggregate the traffic data into multiple bidirectional flows at preset time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>; Feature extraction is performed on the bidirectional flow obtained by aggregation to obtain the characteristics of the aggregated flow, so as to obtain the data to be labeled and the unlabeled data according to a preset ratio. The data to be labeled is obtained by manual labeling and human-machine assisted labeling to obtain the labeled data.

3. The method according to claim 1, characterized in that The preprocessing of the labeled data and the unlabeled data to obtain labeled samples and unlabeled samples includes: An unreasonable deletion operation, a redundant data screening operation, a feature encoding operation and / or a feature normalization operation are performed on the labeled data and the unlabeled data respectively to obtain the labeled samples and the unlabeled samples.

4. A network anomaly detection device, characterized in that: The network anomaly detection method according to any one of claims 1 to 3 above comprises: A collection module is used to collect network traffic data at the entrance of the network node, and perform flow-level aggregation and feature extraction on the network traffic data to obtain labeled data and unlabeled data in a preset ratio. The labeled data is obtained by manual labeling and human-machine assisted labeling. A processing module, configured to preprocess the labeled data and the unlabeled data to obtain labeled samples and unlabeled samples; a training module, configured to jointly train a detection model based on an autoencoder and confidence-assisted classification using the labeled samples and the unlabeled samples to generate a semi-supervised network anomaly detection model; and The detection module is used to detect the flow data to be measured using the semi-supervised network anomaly detection model, and identify the anomaly results of the flow data to be measured based on the output results of the semi-supervised network anomaly detection model.

5. The device according to claim 4, characterized in that The acquisition module includes: an aggregation unit, configured to aggregate the network traffic data into multiple bidirectional flows at preset time intervals based on the same five-tuple <source IP, source port, destination IP, destination port, protocol>; The acquisition unit is used to extract features from the bidirectional flow obtained by aggregation to obtain features of the aggregated flow, so as to obtain the data to be labeled and the unlabeled data according to a preset ratio. The data to be labeled is obtained by manual labeling and human-machine assisted labeling to obtain labeled data.

6. The device according to claim 4, characterized in that The processing module is further used to perform unreasonable deletion operations, redundant data screening operations, feature encoding operations and / or feature normalization operations on the labeled data and the unlabeled data respectively to obtain the labeled samples and the unlabeled samples.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program and a learning model stored in the memory and executable on the processor, wherein the processor executes the program and the model to implement the network anomaly detection method according to any one of claims 1 to 3.

8. A computer-readable storage medium having a computer program and a learning model stored thereon, characterized in that: The program and the model are executed by a processor to implement the network anomaly detection method according to any one of claims 1 to 3.

Images