A network unknown threat detection method based on feature extended CNN

Abstract

The present invention discloses a method for detecting unknown network threats based on feature-expanded CNN. A feature-expanded CNN model is constructed based on the fact that many unknown network threats and known threats originate from the same family and are characterized by similar sample features. First, a convolution operation is performed on the original data at each layer of the CNN network to obtain a native feature map; then a linear random operation is performed on the native feature map to obtain an extended feature map; finally, the two are combined to obtain extended reconstructed data of the original data, whose dimension is lower than that of the original data, thereby realizing dimensionality reduction and extended reconstruction of the data. A security data classification model is then constructed based on a shallow machine learning algorithm to realize the detection of unknown threats in network security big data. The method for detecting unknown network threats based on feature-expanded CNN proposed by the present invention generates extended reconstructed features, which not only realize dimensionality reduction, but also expand the data representation of unknown threats, realize high-precision detection of unknown threats, and reduce computational complexity.

Description

Technical Field

[0001] The present invention belongs to the technical field of data analysis, and relates to network security big data analysis and modeling, and in particular to a network unknown threat detection method based on feature-extended CNN. Background Art

[0002] The attack and defense of network security is like a cat-and-mouse game. Hackers and cyber criminals are constantly trying various covert and new attack methods to gain more benefits, such as stealing data, controlling hosts, extorting money, etc. However, these new attack methods are not created out of thin air. Cyber ​​criminals usually find an existing malware, and then make some minor adjustments to transform it into a new malware that meets their needs. They even find and exploit a 0day vulnerability to allow it to evade detection by security software. Most of the functions of these new malware are the same as the old ones, and viruses with similar functions are usually considered to be a family. Since many malicious codes come from the same family, the detection of unknown attacks that are not yet understood can be detected based on the patterns and characteristics of known network attacks that we have mastered.

[0003] Currently, all major antivirus vendors are moving towards machine learning methods to keep up with the ever-changing threat environment. However, with more than 1 million new malware being released every day, traditional machine learning methods are no longer up to the task. As deep learning has made breakthrough progress in tasks such as image classification, object detection, and scene recognition, its powerful data learning capabilities and scalability have attracted the attention of security researchers. Therefore, using emerging deep learning technologies to improve malware detection capabilities has become an important aspect of network security detection.

[0004] Deep learning technology includes a variety of algorithms, such as convolutional neural networks (CNN), recurrent neural networks (RNN), and generative adversarial networks (GAN). Among them, the CNN algorithm uses the nonlinear operation of the convolution layer to learn and re-characterize the data features, and uses the compression operation of the pooling layer to reduce the dimension of the data features. Therefore, the CNN algorithm can be used to process and reconstruct network security data. The basic network structure of CNN contains an input layer, a convolution layer, a fully connected layer, and an output layer. Among them, the convolution operation of the convolution layer uses multiple convolution kernels to translate the input data vector for inner product operation to obtain the corresponding feature map. Different convolution kernels in the same layer are used to extract features of different modes, and convolution kernels in different layers are used to extract features of different levels. For unknown threats and known threats from the same family, there are similarities in sample features. The CNN network can be used to extract sample features. After the CNN convolution operation, the native feature map is obtained, which is used to represent the known network threat data. The native feature map is randomly linearly expanded to obtain an extended feature map. The extended feature map has certain similarities and differences with the native feature map and can be used to characterize unknown threats. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention proposes a network unknown threat detection method based on feature extended CNN. By utilizing the fact that threats of the same family have certain similarities in sample features, a feature extended CNN model is used to characterize known threats and unknown threats with native feature maps and extended feature maps respectively, and extended reconstructed features are generated for classification detection, thereby improving detection accuracy while reducing computational complexity.

[0006] A method for detecting unknown network threats based on feature-extended CNN specifically includes the following steps:

[0007] Step 1: Build a dataset

[0008] The original data set is divided into a training set and a test set according to the data category labels. The samples in the training set and the samples in the test set are all threat attack samples from the same family but different types. The samples in the training set are regarded as known threats, and the samples in the test set are regarded as unknown threats.

[0009] Step 2: Build and train the feature-expanded CNN model

[0010] Based on the basic CNN algorithm, a feature expansion CNN algorithm model is constructed to expand, reconstruct and reduce the dimension of the input data set. The model includes an input layer, L convolutional layers, L pooling layers, a fully connected layer, a data connection layer and a Softmax layer.

[0011] Based on the CNN model, a feature expansion CNN algorithm model is constructed to expand, reconstruct and reduce the dimension of the input data set. The feature expansion CNN algorithm model linearly and randomly expands the original feature map output by the convolution layer to obtain an extended convolution map, and then merges the original feature map with the extended convolution map and inputs it into the next layer of the network.

[0012] The input layer is used for inputting the training set X.

[0013] The convolution layer contains a certain number of convolution kernels. First, the training set is input into the convolution layer, and the training set and the convolution kernel undergo convolution operations and nonlinear activation operations to obtain a native feature map. Then, the native feature map is linearly randomly expanded to obtain an extended convolution map, and then the native feature map and the extended convolution map are merged to form a complete feature map.

[0014] The pooling layer uses the maximum value pooling method to downsample all feature maps output by the convolution layer, and then obtains a pooling matrix through a nonlinear activation operation.

[0015] The fully connected layer uses global convolution to perform global convolution on the pooling matrix output by the last pooling layer to obtain multiple groups of extended reconstruction matrices. The dimension of the output reconstruction matrix can be set in the fully connected layer. If the dimension of the output reconstruction matrix is ​​less than the dimension of the original data, data dimensionality reduction can be achieved.

[0016] The data connection layer connects multiple groups of expanded reconstruction matrices output by the fully connected layer to obtain a group of reconstruction features.

[0017] The input of the Softmax layer is connected to the output of the data connection layer to determine the category of the reconstructed data, compare it with the original data, and calculate the data loss.

[0018] The feature expanded CNN model is trained multiple times until the loss approaches 0.

[0019] In the process of iterative training of the feature-expanded CNN model, the Adam optimization function is used to optimize the model's loss function Loss to the minimum value. At the end of the feature-expanded CNN model training, the data dimension obtained from the output of the fully connected layer after the model training is completed is smaller than the dimension of the original data, indicating that the dimension of the expanded reconstruction matrix is ​​lower than the original data matrix, that is, the feature-expanded CNN model achieves dimensionality reduction of the reconstruction matrix to the original matrix.

[0020] Preferably, the number of times the feature expansion CNN model is cyclically trained is 1000.

[0021] Step 3: Build and train a classification model based on shallow learning

[0022] Input the reconstructed features output by the fully connected layer in step 2 into the security data classification model to obtain the predicted sample category label. Set the performance target, compare the predicted sample category label with the true category label, and calculate the performance of the classification model based on the confusion matrix evaluation index. When the performance of the classification model does not reach the preset target, return to step 3, retrain and optimize the feature expansion CNN model; when the performance of the classification model reaches the preset target, proceed to the next step.

[0023] Preferably, the shallow machine learning algorithm is a support vector machine, a decision tree, a linear regression or a naive Bayes.

[0024] Preferably, the performance of the classification model includes the correctness, precision and recall rate of the classification model.

[0025] Step 4: Unknown Threat Detection

[0026] The test data set containing unknown data is input into the feature expansion CNN model trained and optimized in step 2 to obtain the reconstructed features of the test data set. Then, it is input into the shallow learning classification model trained and optimized in step 3 to obtain the predicted category of the test data set and identify the threat samples, thereby realizing the detection of unknown threat data in the test set.

[0027] The present invention has the following beneficial effects:

[0028] (1) According to the 1D structure of the input data, a feature expansion CNN model based on 1D-CNN is constructed, in which the convolution kernel and pooling sampling are both in 1D matrix style. Compared with the 2D-CNN model in the prior art, the operation of the 1D-CNN network is simpler and the amount of operation is reduced accordingly, which can improve the operation efficiency of the model;

[0029] (2) In the convolution layer of the feature expansion CNN model, the calculation of feature maps includes two methods: one is the direct convolution method, which uses the convolution operation to perform convolution operations on the original data to obtain the original feature map; the other is the extended feature method, which uses linear random operations on the original feature map to obtain the extended feature map, and then merges the two to obtain the entire feature map. The extended feature map is derived from the original feature map, that is, the extended feature map contains the information of the original data and the expanded information, representing unknown network attacks that are similar to the known network attacks. Therefore, the extended feature map can be used to represent the feature information of unknown threat attacks.

[0030] (3) In the operation process of the feature expansion CNN model, the calculation of feature maps includes two methods: direct convolution method and extended feature method. The extended feature method directly performs random number multiplication operations on the native feature map, instead of complex convolution multiplication operations like the direct convolution method. Therefore, compared with the basic CNN model that requires all convolution operations, the feature expansion CNN model can reduce the computational complexity and model parameters.

[0031] (4) Through the convolution operation, pooling operation and convolution operation of the fully connected layer of the feature expansion CNN, the dimension of the reconstructed feature can be controlled. When the dimension is lower than the dimension of the original data, the dimensionality of the data is reduced, thereby improving the performance of the reconstructed data based on shallow machine learning classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Flowchart of the network unknown threat detection method based on feature extended CNN. DETAILED DESCRIPTION

[0033] The present invention will be further explained below with reference to the accompanying drawings;

[0034] like Figure 1 As shown in FIG. 1 , a network unknown threat detection method based on feature-extended CNN includes model construction and training optimization. The specific process is as follows:

[0035] Step 1: Build a dataset

[0036] One-hot encode the original collected security data to construct a training set X and a test set X of size N*D test , X=(x 1 ,x 2 ,…,x n ,…x N ), where N is the number of samples in the dataset, D is the dataset dimension, and Y is the set of true category labels corresponding to the training set X. The samples in the training set are regarded as known data, and the samples in the test set are regarded as unknown data. The known data and unknown data come from the same family of network threats.

[0037] Step 2: Build and train the feature-expanded CNN model

[0038] Based on the basic CNN algorithm, a feature-expanded CNN algorithm model is constructed to reconstruct and reduce the dimension of the input data set. The model includes an input layer, L convolutional layers, L pooling layers, a fully connected layer, a data connection layer and a Softmax layer.

[0039] The input layer is used for inputting the training set X.

[0040] The convolutional layer, where the output of the l-th (1 < l ≤ L) convolutional layer is connected to the l-th pooling layer after passing through the non-linear activation function ReLU(·); when l = 1, the input of the convolutional layer is connected to the output of the input layer, and when l > 1, the input of the convolutional layer is connected to the output of the (l - 1)-th pooling layer that has passed through the non-linear activation function ReLU(·). M convolutional kernels are set for each convolutional layer. The length of the convolutional kernels in the first convolutional layer is K, and the length of the convolutional kernels in other convolutional layers is K / 2. Assume that the m-th (0 < m ≤ M) convolutional kernel in the first layer is represented as The m-th convolutional kernel in the l-th layer is represented as The data input to the convolutional layer is convolved with the M convolutional kernels to obtain M feature map matrices, and then M non-linear mapping feature map matrices are obtained after passing through the non-linear activation function ReLU(·). Assume that the output of the convolutional layer is the feature map Contains the original feature map And the extended convolutional map The calculation is as follows:

[0041]

[0042]

[0043]

[0044] Among them, conv1D(·) represents the convolution function, Represents the offset. random(a) represents a random number with a value range of (0, a], and concatenate(·) is the matrix concatenation function.

[0045] The pooling layer, where the output of the L-th pooling layer is connected to the input of the fully connected layer after passing through the non-linear activation function ReLU(·). The pooling layer uses the maximum pooling method and uses the pooling matrix P l m Perform downsampling on the m-th non-linear mapping feature matrix output by the l-th convolutional layer And then pass through the non-linear activation function ReLU(·) to obtain the m-th pooled non-linear mapping feature matrix

[0046]

[0047] Among them, maxpooling(·) represents the maximum pooling function.

[0048] The fully connected layer performs global convolution operation on the m-th pooled mapping feature matrix output by the L-th pooling layer using the convolutional kernel To achieve non-linear changes in the feature space; the output of the L-th pooling layer After global convolution, the nonlinear activation function ReLU(·) is used to obtain the reconstruction matrix X′ m In this layer, the dimension of the output reconstruction matrix can be set to D′.

[0049]

[0050] The data connection layer reconstructs the matrix X by computing the data obtained by each convolution kernel of the Lth convolution layer and each pooling filter of the Lth pooling layer. m ' are connected to obtain a set of reconstruction matrices X' with a dimension of D':

[0051] X′=concatenate(X m ′), (6)

[0052] The output reconstruction matrix X′ of the feature expansion CNN obtained above is input into the softmax layer to obtain the sample category label Y′ in the predicted reconstruction feature matrix X′:

[0053] Y′=softmax(X′). (7)

[0054] The predicted sample category label Y′ is compared with the actual category label Y, and the loss function Loss of the feature expansion CNN model is defined based on the cross entropy loss function.

[0055] Loss=crossentropy(Y,Y′), (8)

[0056] Among them, crossentropy(·) represents the cross entropy loss function.

[0057] The feature expansion CNN model was trained 1000 times in a loop. During the iterative training of the feature expansion CNN model, the Adam optimization function was used to continuously optimize the model's loss function Loss until it tended to 0. At the end of the feature expansion CNN model training, the feature matrix X' with a size of N×D' was obtained from the output of the fully connected layer after the feature expansion CNN model training was completed, where D'≤D, indicating that the dimension of the reconstructed matrix is ​​lower than the original data matrix, that is, the feature expansion CNN model achieves dimensionality reduction of the reconstructed matrix to the original matrix.

[0058] Step 3: Build and train a classification model based on shallow learning

[0059] Construct a security data classification model based on shallow machine learning algorithms such as support vector machines, decision trees, and linear regression. Input the reconstructed feature matrix X′ obtained in step 2 into the security data classification model to obtain the predicted sample category label Y″.

[0060] Set the performance target, compare the predicted sample category label Y″ with the true category label Y, and calculate the performance of the classification model according to the confusion matrix evaluation index, including the correctness, precision and recall rate of the classification model. When the performance of the classification model does not reach the preset target, return to step 2, retrain and optimize the feature expansion CNN model; when the performance of the classification model reaches the preset target, proceed to the next step.

[0061] Step 4: Unknown Threat Detection

[0062] The test dataset X contains unknown data. test Input it into the feature expansion CNN model trained and optimized in step 2 to obtain the test data set X test The reconstructed feature matrix X′ test , and then input it into the shallow learning classification model trained and optimized in step 3 to obtain the test data set X test The predicted category Y′ test , identify the threat samples, and detect unknown threat data in the test set.

[0063] Step 5: Experimental verification

[0064] According to the above steps, the public data set is input into the threat detection model based on deep learning and shallow learning, and the model is trained and tested to verify the effectiveness of this method.

Claims

1. A network unknown threat detection method based on feature-extended CNN, characterized by: The method comprises the following steps: Step 1: Build a dataset The original data set is divided into a training set and a test set according to the data category labels. The samples in the training set and the test set are all threat attack samples from the same family but different types. The samples in the training set are regarded as known threats, and the samples in the test set are regarded as unknown threats. Step 2: Build and train the feature-expanded CNN model Based on the CNN model, a feature expansion CNN algorithm model is constructed to expand, reconstruct and reduce the dimension of the input data set; the feature expansion CNN algorithm model linearly and randomly expands the original feature map output by the convolution layer to obtain an extended convolution map, and then merges the original feature map with the extended convolution map and inputs it into the next layer of the network; The feature expansion CNN model consists of an input layer, L groups of convolutional layers and pooling layers, a fully connected layer, a data connection layer and a Softmax layer in sequence; The input layer is used to input the training set X. The convolution layer obtains the original feature map through convolution operation and nonlinear activation operation, and then obtains the extended convolution map by linear random expansion of the original feature map. The original feature map and the extended convolution map are merged to output all feature maps. The pooling layer uses the maximum value pooling method to downsample all feature maps and perform nonlinear activation operations to output the pooling matrix. The fully connected layer uses global convolution to perform global convolution on the pooling matrix output by the last pooling layer to obtain multiple groups of extended reconstruction matrices. The data connection layer connects the multiple groups of extended reconstruction matrices output by the fully connected layer to obtain a set of reconstructed features. The Softmax layer determines the category of the reconstructed data through the reconstructed features, compares it with the original data, and calculates the data loss. The feature expansion CNN model is trained repeatedly until the loss approaches 0; Step 3: Build and train a classification model based on shallow learning Input the reconstructed features output by the fully connected layer in step 2 into the shallow learning classification model to obtain the predicted sample category label; set the performance target, compare the predicted sample category label with the true category label, and calculate the performance of the classification model according to the confusion matrix evaluation index; when the performance of the classification model does not reach the preset target, return to step 3, retrain and optimize the feature expansion CNN model; when the performance of the classification model reaches the preset target, proceed to the next step; Step 4: Unknown Threat Detection The test data set containing unknown data is input into the feature expansion CNN model trained and optimized in step 2 to obtain the reconstructed features of the test data set. Then, it is input into the shallow learning classification model trained and optimized in step 3 to obtain the predicted category of the test data set and identify the threat samples, thereby realizing the detection of unknown threat data in the test set.

2. A method for detecting unknown network threats based on feature-extended CNN as claimed in claim 1, characterized in that: After the original data set is One-hot encoded, it is split into training set and test set according to the category label of the data.

3. A method for detecting unknown network threats based on feature-extended CNN as claimed in claim 1, characterized in that: Sets the dimension of the output reconstruction matrix in fully connected layers.

4. A method for detecting unknown network threats based on feature-extended CNN as claimed in claim 1, characterized in that: During the iterative training of the feature-expanded CNN model, the Adam optimization function is used to optimize the model's loss function Loss to the minimum value.

5. A method for detecting unknown network threats based on feature-extended CNN as claimed in claim 1, characterized in that: The number of loop training for the feature expansion CNN model is 1000.

6. A method for detecting unknown network threats based on feature-extended CNN as claimed in claim 1, characterized in that: Shallow learning classification models are support vector machines, decision trees, linear regression, or naive Bayes.

7. A method for detecting unknown network threats based on feature-extended CNN as claimed in claim 1, characterized in that: The performance of the classification model includes the accuracy, precision and recall rate of the classification model.

Images