Adversarial attack defense method and system based on feature grouping and multi-model fusion
By using feature grouping and multi-model fusion, adversarial examples are generated and data preprocessed. Multiple LSTM models are then used for feature grouping and result fusion, which solves the defense problem of network intrusion detection systems when facing unknown adversarial attacks and improves the detection capability of adversarial examples.
Patent Information
- Application Number
- CN202111239175.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-10-25
- Publication Date
- 2026-02-10
- Estimated Expiration
- 2041-10-25
AI Technical Summary
Existing network intrusion detection systems struggle to effectively defend against unknown adversarial attacks, and the defense process may reduce detection accuracy or recall.
We employ feature grouping and multi-model fusion to generate adversarial examples and perform data preprocessing. We then use multiple LSTM models for feature grouping and result fusion to detect malicious traffic.
It effectively defends against unknown adversarial attacks, improves the recall rate of adversarial samples, and maintains the detection accuracy without decreasing in the absence of adversarial attacks.
Smart Images
Figure CN114091020B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and system for defending against adversarial attacks based on feature grouping and multi-model fusion. Background Technology
[0002] Network Intrusion Detection System (NIDS) is a key technology in the field of network security, aiming to detect anomalies in the network and discover malicious attacks. Currently, deep learning-based network intrusion detection technology has high accuracy and can also detect zero-day attacks, so it is widely used. The general process of deep learning-based network intrusion detection method is as follows: (1) Obtain the training set, i.e., network traffic data, and preprocess the network traffic data to convert the network traffic into a flow; (2) Extract the features of the flow, and form a feature vector for each flow; (3) Design an appropriate deep learning model and train the deep learning model with the training set; (4) Use the trained model to detect anomalies or malicious attacks in the network.
[0003] However, deep learning technology also has weaknesses. When attackers modify the original sample data with minute noise to create adversarial examples, deep learning-based intrusion detection systems can make incorrect judgments, leading them to identify malicious attack samples as normal ones. Ensuring the security of network intrusion detection systems themselves, and enabling them to correctly detect malicious attacks even under adversarial conditions, thereby improving the robustness of network intrusion detection systems, is a pressing issue.
[0004] Existing network intrusion detection systems often employ the following methods:
[0005] 1. Adversarial Training. Adversarial training generates adversarial examples using various classic adversarial attack algorithms, then adds these examples to the training set to retrain the deep learning model. However, because adversarial training requires adversarial examples, corresponding adversarial examples must be generated for each possible adversarial attack algorithm. This requires exhausting all possible adversarial attack algorithms, and it cannot defend against some adversarial attacks that have not appeared before, reducing the recall rate in the adversarial example scenario.
[0006] 2. Feature Reduction. In the field of network security, attackers cannot arbitrarily modify the features of the flow when generating adversarial examples, because modifying some features would disable the attack function or disrupt the underlying logic of the network flow. Therefore, attackers can only modify the modifiable features when generating adversarial examples, leaving other features unchanged. Based on this, some defense methods delete features that can be modified by attackers; that is, these modifiable features are not in the feature vector, so no matter how the attacker modifies the original sample, the result is unaffected. However, feature reduction, due to the reduction of features, removes many features that can distinguish normal samples from malicious samples, causing some normal samples to be identified as malicious samples, reducing the accuracy of network intrusion detection systems in the absence of adversarial attacks. Summary of the Invention
[0007] The present invention aims to provide a method and apparatus for adversarial attack defense based on feature grouping and multi-model fusion to overcome or at least partially solve the above problems.
[0008] To achieve the above objectives, the technical solution of the present invention is specifically implemented as follows:
[0009] One aspect of the present invention provides an adversarial attack defense method based on feature grouping and multi-model fusion, comprising: generating adversarial samples according to a preset adversarial attack algorithm and adding them to a test set; performing data preprocessing on the training set and the test set respectively to form feature vectors of network flows; grouping features for each flow; and using a multi-model fusion algorithm to detect malicious traffic.
[0010] The step of generating adversarial samples according to a preset adversarial attack algorithm includes: analyzing the distribution of normal samples and malicious samples on the features to be modified, and then using the features f of the malicious samples to be modified. i Modify the features to fall within the range of normal samples; based on the relationships between the various features, modify the features f of the malicious sample to be modified. i Other relevant features are used to generate the adversarial examples.
[0011] The data preprocessing includes: converting non-numerical features in the original features of the stream into numerical features; identifying a stream with a unique identifier; filtering out features that can identify malicious samples and normal samples to obtain a feature set; and normalizing the data in the feature set.
[0012] The feature grouping for each stream includes dividing the feature set into three groups: feature set F1, feature set F2, and feature set F3, such that...
[0013] The method of using a multi-model fusion algorithm for malicious traffic detection includes: generating three feature vectors X1, X2, and X3 based on feature sets F1, F2, and F3 respectively; feeding these three feature vectors into three deep learning models respectively; fusing the learning results of the three deep learning models to obtain a malicious traffic detection model; and using the malicious traffic detection model to detect malicious traffic. The three deep learning models include: Model 1, Model 2, and Model 3, each based on an LSTM model. Model 1 has 6 input layer neurons, Model 2 has 5 input layer neurons, and Model 3 has 11 input layer neurons. Each of Model 1, Model 2, and Model 3 includes 4 hidden layers. The number of neurons in each model is 20, 60, 80, and 90, respectively. Model 1, Model 2, and Model 3 each include an output layer with one neuron, forming a binary classification model. The activation functions for the input and hidden layers of Model 1, Model 2, and Model 3 are "tanh," and the activation function for the output layer is "sigmoid." During the training phase, the three deep learning models are trained using their respective feature vectors. During the testing phase, the three deep learning models provide test results, denoted as p1, p2, and p3, respectively. The malicious traffic detection model calculates the final detection result using the following formula: p = avg(p1, p2, p3). The malicious traffic detection model identifies the flow as malicious when p is greater than or equal to 0.5, and identifies the flow as normal when p is less than 0.5.
[0014] Another aspect of the present invention provides an adversarial attack defense system based on feature grouping and multi-model fusion, comprising: an adversarial attack module for generating adversarial samples according to a preset adversarial attack algorithm and adding them to a test set; a data preprocessing module for preprocessing the training set and the test set respectively to form feature vectors of network flows; a feature grouping module for grouping features of each flow; and a malicious traffic detection module for detecting malicious traffic using a multi-model fusion algorithm.
[0015] The adversarial attack module generates adversarial samples according to a preset adversarial attack algorithm in the following manner: Specifically, the adversarial attack module analyzes the distribution of normal and malicious samples on the features to be modified, and then modifies the features f of the malicious samples to be modified. i Modify the features to fall within the range of normal samples; based on the relationships between the various features, modify the features f of the malicious sample to be modified. i Other relevant features are used to generate the adversarial examples.
[0016] The data preprocessing module performs data preprocessing in the following manner: Specifically, the data preprocessing module converts non-numerical features in the original features of the stream into numerical features; identifies a stream with a unique identifier; filters out features that can identify the malicious samples and normal samples to obtain a feature set; and normalizes the data in the feature set.
[0017] The feature grouping module groups each stream in the following manner: specifically, the feature grouping module divides the feature set into three groups: feature set F1, feature set F2, and feature set F3, such that...
[0018] The malicious traffic detection module employs a multi-model fusion algorithm to detect malicious traffic in the following manner: Specifically, the malicious traffic detection module generates three feature vectors X1, X2, and X3 based on feature sets F1, F2, and F3, respectively, and feeds these three feature vectors into three deep learning models; the learning results of the three deep learning models are fused to obtain a malicious traffic detection model; and malicious traffic is detected using this model. The three deep learning models include: Model 1, Model 2, and Model 3, each based on an LSTM model; Model 1 has 6 input layer neurons, Model 2 has 5 input layer neurons, and Model 3 has 11 input layer neurons; Model 1, Model 2, and Model 3 each include 4 hidden layers with 20 neurons in each hidden layer. 60, 80, 90; Model 1, Model 2, and Model 3 each include an output layer with one neuron, forming a binary classification model; The activation functions of the input and hidden layers of Model 1, Model 2, and Model 3 are "tanh", and the activation function of the output layer is "sigmoid"; The malicious traffic detection module uses the malicious traffic detection model to detect malicious traffic in the following way: Specifically, during the training phase, the three deep learning models are trained using their corresponding feature vectors; during the testing phase, the three deep learning models give test results, denoted as p1, p2, and p3 respectively; The malicious traffic detection model calculates the final detection result using the following formula: p = avg(p1, p2, p3); When p is greater than or equal to 0.5, the malicious traffic detection model identifies the flow as malicious; when p is less than 0.5, the flow is identified as normal.
[0019] Therefore, the adversarial attack defense method and system based on feature grouping and multi-model fusion provided by this invention does not require retraining of deep learning models, can defend against adversarial attacks that have never occurred before, and will not reduce detection accuracy in scenarios without adversarial attacks. Attached Figure Description
[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0021] Figure 1 A flowchart illustrating the adversarial attack defense method based on feature grouping and multi-model fusion provided in this embodiment of the invention;
[0022] Figure 2 A framework diagram of an adversarial attack defense method based on feature grouping and multi-model fusion provided in an embodiment of the present invention;
[0023] Figure 3 This is a schematic diagram of the structure of an adversarial attack defense system based on feature grouping and multi-model fusion provided in an embodiment of the present invention. Detailed Implementation
[0024] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
[0025] Figure 1 The flowchart of the adversarial attack defense method based on feature grouping and multi-model fusion provided by an embodiment of the present invention is shown. See also Figure 1 The adversarial attack defense method based on feature grouping and multi-model fusion provided in this embodiment of the invention includes:
[0026] S1, Generate adversarial samples according to the preset adversarial attack algorithm and add them to the test set.
[0027] Specifically, the dataset used in this invention is Bot-IoT, and the original network traffic data format is a pcap file. The Argus tool is used to convert the original network traffic into a flow and extract the features of the flow. The features and descriptions in the Bot-IoT dataset are shown in Table 1.
[0028] Table 1. Characteristics and descriptions of the Bot-IoT dataset
[0029]
[0030]
[0031]
[0032] As an optional implementation of this invention, generating adversarial samples according to a preset adversarial attack algorithm includes: analyzing the distribution of normal samples and malicious samples on the features to be modified, and then using the features f of the malicious samples to be modified... i Modify the features to fit within the range of normal samples; based on the relationships between the various features, modify the features f of the malicious sample to be modified. i Other relevant features are used to generate adversarial examples.
[0033] Specifically, this invention designs an adversarial attack algorithm, generates adversarial samples, and adds them to a test set, which includes three parts: normal samples, malicious samples, and adversarial samples. The adversarial attack algorithm in this invention employs a feature modification method based on eigenvalue distribution. Under certain constraints, attackers can only modify features that do not disrupt the underlying logic of network communication and do not impair the attack functionality, such as the number of data packets and the number of bytes. The steps are as follows:
[0034] (1) First, analyze the distribution of normal and malicious samples on the features to be modified, and modify the features of the malicious samples to be modified to the range of the features of normal samples; if there are multiple features to be modified, the distribution of normal and malicious samples should be analyzed for each feature, and then each feature should be modified separately.
[0035] (2) Then modify the relevant features, which depend on the features modified in step (1) above. Analyze the relationship between the features and make corresponding modifications. For example, the total number of data packets = the number of data packets sent + the number of data packets received. If the number of data packets sent / received was modified in step (1) above, then the total number of data packets will be modified accordingly.
[0036] For the Bot-IoT dataset, the correlations between features are as follows:
[0037] pkts = spkts + dpkts
[0038] bytes = sbytes + dbytes
[0039] rate=(pkts-1) / dur
[0040] srate = (spkts - 1) / dur
[0041] drate=(dpkts-1) / dur
[0042] Furthermore, the present invention also designs a defense method, the framework diagram of which is shown below. Figure 2 As shown, it mainly consists of three parts: data preprocessing (step S2), feature grouping (step S3), and malicious traffic detection (step S4). Among them:
[0043] S2 performs data preprocessing on the training and test sets respectively to form the feature vectors of the network flow.
[0044] Specifically, data preprocessing involves processing the raw network traffic data (.pcap format) into a stream, forming the raw characteristics of the stream, and then performing further processing.
[0045] As an optional implementation of this invention, data preprocessing includes: converting non-numerical features in the original features of the stream into numerical features; identifying a stream with a unique identifier; filtering out features that can identify malicious samples and normal samples to obtain a feature set; and normalizing the data in the feature set.
[0046] Specifically, the main data preprocessing tasks include:
[0047] (1) Conversion: Non-numerical features in the original features of the stream need to be converted into numerical features to facilitate processing by deep learning models. For example, for the Bot-IoT dataset, “tcp”, “arp” and “udp” in the protocol proto feature are converted into “1”, “2” and “3” respectively; and “RST”, “CON” and “REQ” in the state feature are converted into “1”, “2” and “3” respectively.
[0048] (2) Identification: A flow is identified by a unique identifier, which allows a flow to be uniquely located. In this invention, a flowID is formed by the five-tuple (source IP address saddr, source port number sport, destination IP address daddr, destination port number dport, protocol proto) to identify a flow.
[0049] (3) Filtering: Not all features of a flow need to be fed into the deep learning model. Some features are not very useful for the model's detection. Therefore, it is necessary to filter out features that can identify malicious and normal flows, such as the total number of data packets, the number of data packets sent / received, the total number of bytes, the number of bytes sent / received, the flow status, the flow label, the time interval, the data rate, etc. The filtered feature set is denoted as F. For the Bot-IoT dataset, the filtered features include: flgs_number, pkts, bytes, state_number, seq, dur, mean, stddev, sum, min, max, spkts, dpkts, sbytes, dbytes, rate, srate, drate, a total of 18 features.
[0050] (4) Normalization: Since the value ranges of each feature are different, directly feeding the features into the deep learning model will reduce the accuracy of the model. Therefore, the data needs to be normalized. This invention uses the Min-Max normalization method. Let xi represent the original feature and x′i represent the normalized feature. The calculation formula for Min-Max normalization is as follows:
[0051]
[0052] x min and x max These are the minimum and maximum values of the original features, where a and b are the set minimum and maximum values of the features, i.e., x′. i ∈[a, b], where a = 0 and b = 1.
[0053] S3, group each stream by feature.
[0054] Specifically, based on the category and characteristics of the features, the feature set F selected in the data preprocessing stage is grouped. In this invention, the features are divided into 3 groups, which are denoted as F1, F2, and F3 respectively.
[0055] As an optional implementation of this invention, feature grouping for each stream includes: dividing the feature set into three groups: feature set F1, feature set F2, and feature set F3, such that...
[0056] Specifically, the present invention divides the features into three groups, denoted as F1, F2, and F3, respectively, such that... F1, F2, and F3 will be fed into three deep learning models, respectively. For the Bot-IoT dataset, the features are grouped as follows:
[0057] F1={flgs_number, state_number, seq, stddev, sum, dur}
[0058] F2={min, max, mean, flgs_number, state_number}
[0059] F3={spkts, dpkts, sbytes, dbytes, srate, drate, rate, pkts, bytes, flgs_number, state_number}
[0060] S4 employs a multi-model fusion algorithm for malicious traffic detection.
[0061] Specifically, the malicious traffic detection phase uses three deep learning models for detection, and then the results of these three models are combined to obtain the final judgment.
[0062] As an optional implementation of this invention, the malicious traffic detection using a multi-model fusion algorithm includes: generating three feature vectors X1, X2, and X3 based on feature sets F1, F2, and F3 respectively; feeding the three feature vectors into three deep learning models respectively; fusing the learning results of the three deep learning models to obtain a malicious traffic detection model; and using the malicious traffic detection model to detect malicious traffic.
[0063] As an optional implementation of this invention, three deep learning models are included: Model 1, Model 2, and Model 3, which are all based on LSTM (Long Short-Term Memory) models. Model 1 has 6 input layer neurons, Model 2 has 5 input layer neurons, and Model 3 has 11 input layer neurons. Model 1, Model 2, and Model 3 each include 4 hidden layers with 20, 60, 80, and 90 neurons respectively. Model 1, Model 2, and Model 3 each include an output layer with 1 neuron, which is a binary classification model. The activation functions of the input layer and hidden layer of Model 1, Model 2, and Model 3 are "tanh", and the activation function of the output layer is "sigmoid".
[0064] As an optional implementation of this invention, malicious traffic detection using a malicious traffic detection model includes: during the training phase, three deep learning models are trained using their respective feature vectors; during the testing phase, the three deep learning models provide test results, denoted as p1, p2, and p3 respectively; the malicious traffic detection model calculates the final detection result using the following formula: p = avg(p1, p2, p3); when p is greater than or equal to 0.5, the malicious traffic detection model identifies the flow as malicious; when p is less than 0.5, the flow is identified as normal.
[0065] Specifically, based on the feature sets F1, F2, and F3 obtained from feature grouping, three feature vectors X1, X2, and X3 are generated respectively, and these three feature vectors are fed into three models respectively. Since network traffic is time-series data, the LSTM (Long Short-Term Memory) model is adopted.
[0066] Models 1, 2, and 3 are all based on LSTM models, but they differ in the number of neurons in their input layers. X1, X2, and X3 serve as the inputs to Models 1, 2, and 3, respectively, resulting in 6, 5, and 11 neurons in their input layers. All three models have the same number of hidden layers (4), with 20, 60, 80, and 90 neurons in each layer, respectively. Each model has one output layer with one neuron, making it a binary classification model. The input and hidden layers use the tanh activation function, while the output layer uses the sigmoid activation function.
[0067] During the training phase, the three models are trained separately using their respective feature vectors. During the testing phase, the three models provide test results, denoted as p1, p2, and p3 respectively. The detection model calculates the final detection result using the following formula:
[0068] p = avg(p1, p2, p3)
[0069] When p is greater than or equal to 0.5, the detection model identifies the stream as malicious; when p is less than 0.5, the stream is identified as normal.
[0070] Therefore, the adversarial attack defense method based on feature grouping and multi-model fusion provided by the embodiments of the present invention can detect adversarial attacks that have not appeared before, since the training data of the deep learning model is still the original sample, which includes normal samples and malicious samples, but does not contain adversarial samples.
[0071] Furthermore, this invention groups features according to their categories and feeds them into different deep learning models. If an attacker modifies a certain type of feature, only one model will make a false judgment, while the other models can still make accurate judgments. Because the detection model of this invention fuses the detection results of multiple deep learning models, the final detection result is not affected by adversarial attacks. If an attacker wants to deceive multiple detection models, they need to modify multiple types of features, which will lead to the destruction of the underlying logic of network traffic and even destroy the function of the attack, increasing the difficulty of the attack. Therefore, the detection model of this invention can effectively resist adversarial attacks. On the other hand, since the total number of input features of the multiple detection models of this invention is not reduced, the detection accuracy will not decrease in the absence of adversarial examples.
[0072] Figure 3 This diagram illustrates the structure of an adversarial attack defense system based on feature grouping and multi-model fusion, as provided in an embodiment of the present invention. This system applies the aforementioned method. The following is only a brief description of the structure of the system; for other matters not covered herein, please refer to the relevant descriptions in the aforementioned adversarial attack defense method based on feature grouping and multi-model fusion. Figure 3 The adversarial attack defense system based on feature grouping and multi-model fusion provided in this embodiment of the invention includes:
[0073] The adversarial attack module is used to generate adversarial samples based on preset adversarial attack algorithms and add them to the test set;
[0074] The data preprocessing module is used to preprocess the training and test sets separately to form feature vectors of the network stream;
[0075] The feature grouping module is used to group features for each stream;
[0076] The malicious traffic detection module is used to detect malicious traffic using a multi-model fusion algorithm.
[0077] As an optional implementation of this invention, the adversarial attack module generates adversarial samples according to a preset adversarial attack algorithm in the following manner: The adversarial attack module is specifically used to analyze the distribution of normal samples and malicious samples on the features to be modified, and to modify the features f of the malicious samples to be modified. i Modify the features to fit within the range of normal samples; based on the relationships between the various features, modify the features f of the malicious sample to be modified. i Other relevant features are used to generate adversarial examples.
[0078] As an optional implementation of this invention, the data preprocessing module performs data preprocessing in the following manner: the data preprocessing module is specifically used to convert non-numerical features in the original features of the stream into numerical features; identify a stream with a unique identifier; filter out features that can identify malicious samples and normal samples to obtain a feature set; and normalize the data in the feature set.
[0079] As an optional implementation of this invention, the feature grouping module groups each stream in the following manner: Specifically, the feature grouping module divides the feature set into three groups: feature set F1, feature set F2, and feature set F3, such that…
[0080] As an optional implementation of this invention, the malicious traffic detection module employs a multi-model fusion algorithm to detect malicious traffic in the following manner: Specifically, the malicious traffic detection module generates three feature vectors X1, X2, and X3 based on feature sets F1, F2, and F3, respectively, and feeds these three feature vectors into three deep learning models; the learning results of the three deep learning models are fused to obtain a malicious traffic detection model; and malicious traffic is detected using the malicious traffic detection model. The three deep learning models include: Model 1, Model 2, and Model 3, each based on an LSTM model; Model 1 has 6 input layer neurons, Model 2 has 5 input layer neurons, and Model 3 has 11 input layer neurons; Model 1, Model 2, and Model 3 each include 4 hidden layers with 2 neurons each. 0, 60, 80, 90; Model 1, Model 2, and Model 3 each include an output layer with one neuron, forming a binary classification model; The activation functions for the input and hidden layers of Model 1, Model 2, and Model 3 are "tanh", and the activation function for the output layer is "sigmoid"; The malicious traffic detection module uses the malicious traffic detection model to detect malicious traffic in the following way: Specifically, during the training phase, the three deep learning models are trained using their corresponding feature vectors; during the testing phase, the three deep learning models provide test results, denoted as p1, p2, and p3 respectively; The malicious traffic detection model calculates the final detection result using the following formula: p = avg(p1, p2, p3); When p is greater than or equal to 0.5, the malicious traffic detection model identifies the flow as malicious; when p is less than 0.5, the flow is identified as normal.
[0081] Therefore, the adversarial attack defense system based on feature grouping and multi-model fusion provided by the embodiments of the present invention can detect adversarial attacks that have not appeared before, since the training data of the deep learning model is still the original sample, which includes normal samples and malicious samples, but does not contain adversarial samples.
[0082] Furthermore, this invention groups features according to their categories and feeds them into different deep learning models. If an attacker modifies a certain type of feature, only one model will make a false judgment, while the other models can still make accurate judgments. Because the detection model of this invention fuses the detection results of multiple deep learning models, the final detection result is not affected by adversarial attacks. If an attacker wants to deceive multiple detection models, they need to modify multiple types of features, which will lead to the destruction of the underlying logic of network traffic and even destroy the function of the attack, increasing the difficulty of the attack. Therefore, the detection model of this invention can effectively resist adversarial attacks. On the other hand, since the total number of input features of the multiple detection models of this invention is not reduced, the detection accuracy will not decrease in the absence of adversarial examples.
[0083] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A method for defending against adversarial attacks based on feature grouping and multi-model fusion, characterized in that, include: Adversarial samples are generated based on a preset adversarial attack algorithm and added to the test set; The training set and the test set are preprocessed to form feature vectors of the network flow. Each of the streams is grouped by features; A multi-model fusion algorithm is used to detect malicious traffic; in: The feature grouping of each of the streams includes: Divide the feature set into three groups: feature set F1, feature set F2, and feature set F3, such that F1∪F2∪F3=F. The use of a multi-model fusion algorithm for malicious traffic detection includes: Based on the feature set F1, the feature set F2, and the feature set F3, three feature vectors X1, X2, and X3 are generated respectively, and the three feature vectors are fed into three deep learning models respectively. The learning results of the three deep learning models are fused to obtain a malicious traffic detection model; Malicious traffic detection is performed using the aforementioned malicious traffic detection model.
2. The method according to claim 1, characterized in that, The generation of adversarial samples according to the preset adversarial attack algorithm includes: Analyze the distribution of normal and malicious samples on the features to be modified, and then assign the features f of the malicious samples to be modified. i Modify it to the range of features found in normal samples; Based on the relationships between the various features, modify the feature f of the malicious sample to be modified. i Other relevant features are used to generate the adversarial examples.
3. The method according to claim 1, characterized in that, The data preprocessing includes: Convert the non-numerical features in the original features of the flow into numerical features; Use a unique identifier to identify a stream; The feature set is obtained by filtering out the features that can identify the malicious samples and normal samples; The data in the feature set are normalized.
4. The method according to claim 1, characterized in that, The three deep learning models include: Model 1, Model 2, and Model 3, wherein Model 1, Model 2, and Model 3 are each based on an LSTM model; The number of input layer neurons in Model 1 is 6, the number of input layer neurons in Model 2 is 5, and the number of input layer neurons in Model 3 is 11. Model 1, Model 2 and Model 3 each include 4 hidden layers, and the number of neurons in the hidden layers are 20, 60, 80 and 90 respectively; Model 1, Model 2, and Model 3 each include an output layer with one neuron, and are binary classification models; The activation functions for the input and hidden layers of Model 1, Model 2, and Model 3 are "tanh", and the activation function for the output layer is "sigmoid". During the training phase, the three deep learning models are trained using their respective feature vectors. During the testing phase, the three deep learning models respectively provide test results, which are denoted as p1, p2, and p3. The malicious traffic detection model calculates the final detection result using the following formula; p = avg(p1, p2, p3)); The malicious traffic detection model identifies a flow as malicious when p is greater than or equal to 0.5, and identifies a flow as normal when p is less than 0.
5.
5. A defense system against adversarial attacks based on feature grouping and multi-model fusion, characterized in that, include: The adversarial attack module is used to generate adversarial samples based on preset adversarial attack algorithms and add them to the test set; The data preprocessing module is used to preprocess the training set and the test set respectively to form the feature vector of the network stream; A feature grouping module is used to group each of the streams by features; The malicious traffic detection module is used to detect malicious traffic using a multi-model fusion algorithm. in: The feature grouping module performs feature grouping on each stream in the following manner: The feature grouping module is specifically used to divide the feature set into three groups: feature set F1, feature set F2, and feature set F3, such that F1∪F2∪F3=F, The malicious traffic detection module employs a multi-model fusion algorithm to detect malicious traffic in the following manner: The malicious traffic detection module is specifically used to generate three feature vectors X1, X2, and X3 based on the feature set F1, the feature set F2, and the feature set F3, respectively, and to feed the three feature vectors into three deep learning models; to fuse the learning results of the three deep learning models to obtain a malicious traffic detection model; and to use the malicious traffic detection model to detect malicious traffic.
6. The system according to claim 5, characterized in that, The adversarial attack module generates adversarial samples according to a preset adversarial attack algorithm in the following manner: The adversarial attack module is specifically used to analyze the distribution of normal and malicious samples on the features to be modified, and to modify the features f of the malicious samples to be modified. i Modify the features to fall within the range of normal samples; based on the relationships between the various features, modify the features f of the malicious sample to be modified. i Other relevant features are used to generate the adversarial examples.
7. The system according to claim 5, characterized in that, The data preprocessing module performs data preprocessing in the following manner: The data preprocessing module is specifically used to convert non-numerical features in the original features of the stream into numerical features; identify a stream with a unique identifier; filter out features that can identify the malicious samples and normal samples to obtain the feature set; and normalize the data in the feature set.
8. The system according to claim 5, characterized in that, The three deep learning models include: Model 1, Model 2, and Model 3, wherein Model 1, Model 2, and Model 3 are each based on an LSTM model; The number of input layer neurons in Model 1 is 6, the number of input layer neurons in Model 2 is 5, and the number of input layer neurons in Model 3 is 11. Model 1, Model 2 and Model 3 each include 4 hidden layers, and the number of neurons in the hidden layers are 20, 60, 80 and 90 respectively; Model 1, Model 2, and Model 3 each include an output layer with one neuron, and are binary classification models; The activation functions for the input and hidden layers of Model 1, Model 2, and Model 3 are "tanh", and the activation function for the output layer is "sigmoid". The malicious traffic detection module uses the malicious traffic detection model to detect malicious traffic in the following manner: The malicious traffic detection module is specifically used for the following purposes: during the training phase, the three deep learning models are trained using their respective feature vectors; during the testing phase, the three deep learning models provide test results, denoted as p1, p2, and p3 respectively; the malicious traffic detection model calculates the final detection result using the following formula: p = avg(p1, p2, p3); the malicious traffic detection model identifies the flow as malicious when p is greater than or equal to 0.5, and identifies the flow as normal when p is less than 0.5.