Unknown protocol classification method, device, equipment and storage medium

Abstract

The present invention discloses an unknown protocol classification method, device, equipment and storage medium, the method comprising: S100: constructing an N classification model of known category data; S200: preliminarily classifying unknown protocol data A in network environment flow data; S300: constructing an M classification model for known category data and unknown protocol data A, M=N+1; S400: classifying unknown protocol data B from network environment flow data according to the M classification model; S500: updating the N classification model; S600: repeating steps S200-S500 until the data volume of the unknown protocol data set is less than a threshold, outputting the number of categories of the unknown protocol and the final M classification model; S700: classifying the unknown protocols in the network flow data through the final M classification model. The present invention comprehensively uses the results of supervised machine learning and unsupervised machine learning classification to improve the accuracy of unknown protocol labels.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to an unknown protocol classification method, device, equipment and storage medium. Background Art

[0002] Due to the large-scale outbreak of Internet applications, researchers cannot obtain the traffic training sets of all applications; in particular, some special-purpose software is spread in a point-to-point manner, and researchers cannot obtain the application or the traffic training sets of the application, which makes it impossible for researchers to study the traffic identification method of the application in a targeted manner. In other words, in network traffic identification, there is a large amount of unknown protocol traffic, which brings great trouble to network supervision.

[0003] Unknown protocol traffic identification is usually divided into three steps: first, separating unknown protocol traffic from all traffic; second, classifying unknown protocol traffic; and third, identifying specific applications corresponding to the unknown protocol. The present invention mainly focuses on the first step of unknown protocol identification.

[0004] There are two main research ideas for separating unknown protocol traffic from all traffic. One is based on semi-supervised machine learning: in 2007, Erman et al. used a semi-supervised machine learning algorithm and a clustering algorithm to achieve unknown protocol classification; in 2011, Casas et al. achieved unknown protocol classification through integrated clustering; in 2014, Zhang et al. improved Erman's work and proposed the RTC (Robust Network Traffic Classification) method, which achieved unknown protocol classification by sequentially using a clustering algorithm and two supervised machine learning classification algorithms; in 2018, Baker et al. improved the distance calculation formula in the clustering algorithm to achieve unknown protocol classification; in 2020, Zhang et al. achieved unknown protocol classification through the combination of neural networks and clustering algorithms. The other is a method based on a single classifier: in 2007, Crotti et al. realized unknown protocol classification by using a single classifier through regularizing the domain value; in 2009, Este et al. constructed a single classifier based on SVM, and generated a domain value method by comparing the recognition effect of the single classifier on samples of this class and samples of other classes, thereby optimizing the unknown protocol classification effect based on a single classifier.

[0005] Up to now, the unknown protocol classification based on a single classifier requires too many samples and is not practical. The unknown protocol classification based on semi-supervised machine learning algorithms still has the following problems:

[0006] (1) The features used for unknown protocol classification are fixed. The current method uses the same features in multiple iterations and does not have the ability to select and construct features. Using fixed features for multiple clustering and learning does not significantly improve the effectiveness of sample discrimination.

[0007] (2) The accuracy of unknown protocol labels is not high. The current method uses a single artificial intelligence algorithm to label unknown protocols. However, there are many types of unknown protocols in traffic, and a single classification result cannot accurately distinguish whether it is an unknown protocol, resulting in the low label accuracy of the classification model recognition result. Summary of the invention

[0008] The purpose of the present invention is to overcome the defects of the prior art and provide a method, device, equipment and storage medium for classifying unknown protocols. The present invention comprehensively uses the results of supervised machine learning and unsupervised machine learning classification to improve the accuracy of unknown protocol labels.

[0009] The object of the present invention is achieved through the following technical solutions:

[0010] A method for classifying unknown protocols, the method comprising:

[0011] S100: inputting a labeled data set, analyzing the characteristics of known category data, and constructing an N-classification model of the known category data;

[0012] S200: Preliminarily classifying unknown protocol data A in the network environment traffic data according to the N classification model of the known category data;

[0013] S300: constructing M classification models for the known category data and the unknown protocol data A, where M=N+1;

[0014] S400: Classifying unknown protocol data B from network environment traffic data according to the M classification model;

[0015] S500: updating the N classification model according to the unknown protocol data A and the unknown protocol data B;

[0016] S600: If the data volume of the unknown protocol data set is greater than the threshold, repeat steps S200-S500 until the data volume of the unknown protocol data set is less than the threshold, and output the number of categories of the unknown protocol and the final M classification model; if the data volume of the unknown protocol data set is less than the threshold, directly output the number of categories of the unknown protocol and the final M classification model;

[0017] S700: Classifying unknown protocols in the network traffic data by using the final M classification model.

[0018] Furthermore, the S100 specifically includes the following steps:

[0019] S110: Dividing the known category data into a training set and a validation set according to a certain ratio;

[0020] S120: cross validation, inputting a training set, and obtaining a model for classifying the known category data through ensemble learning algorithm training;

[0021] S130: Adjust model parameters to prevent underfitting and overfitting, and obtain the N-classification model.

[0022] Furthermore, the step S200 specifically includes the following steps:

[0023] S210: Input a known category data set and classify it through N classification models to obtain the prediction value of each weak classifier in the ensemble learning {T 1 ,T 2 ,T 3 ,..,T n};

[0024] S220: Input the network data set obtained in a specific environment, classify it through N classification models, and obtain the prediction value {T 1 ,T 2 ,T 3 ,..,T n};

[0025] S230: Discretize the predicted values ​​according to the characteristics of each weak classifier, and finally form a feature vector {W 1 ,W 2 ,W 3 ,..,W n};

[0026] S240: vector {W 1 ,W 2 ,W 3 ,..,W n}The new features of the training data are input into the clustering model, and the network dataset obtained under a specific environment is preliminarily divided into an unknown protocol dataset and a known protocol dataset.

[0027] Furthermore, the S240 specifically includes the following steps:

[0028] S241: Select a specific clustering algorithm, input labeled training data and network data obtained in a specific environment, build a clustering model to obtain clusters;

[0029] S242: for each cluster obtained by classification, determine the number of samples of the known category data set and the total number of samples in the cluster, and further count the samples of the known category data set by category. If samples of a certain known category A account for the majority of the cluster, the category of the cluster is defined as category A.

[0030] S243: For the labeled training data set, calculate the F1 value. If the F1 value is less than the threshold value, repeat steps S241-S243 until the F1 value is greater than the threshold value.

[0031] S244: For the constructed clustering model, determine whether there are samples of the known category data set in the cluster. If not, output it as the unknown protocol data set A.

[0032] Furthermore, the S300 specifically includes the following steps:

[0033] S310: Setting the label of the unknown protocol data set A to N+1;

[0034] S320: dividing the known category data set and the unknown protocol data set A into a training set and a validation set;

[0035] S330: cross validation, inputting a training set, and training a model for classifying the known category data through a machine learning algorithm;

[0036] S340: Adjust model parameters to prevent underfitting and overfitting, and obtain the M classification model.

[0037] Furthermore, the step S400 specifically includes the following steps:

[0038] S410: inputting a network data set obtained under a specific environment and classifying it through the M classification model;

[0039] S420: Synthesize the unknown protocol dataset B with the samples classified into the Mth category.

[0040] Furthermore, the S500 specifically includes the following steps:

[0041] S510: input unknown protocol data set A and unknown protocol data set B, obtain their intersection C, and set the label of the intersection C to N+1;

[0042] S520: input a known category data set, combine it with data set C to form a new known category data set, and update N to N+1;

[0043] S530: Divide the known category data set into a training set and a validation set, perform cross-validation, input the training set, and train a model for classifying the known category data through an ensemble learning algorithm;

[0044] S540: Adjust model parameters to prevent underfitting and overfitting, and obtain the final N-classification model.

[0045] On the other hand, the present invention also provides an unknown protocol classification device, the device comprising:

[0046] An N-classification model building module, used to input a labeled data set, analyze the characteristics of known category data, and build an N-classification model of the known category data;

[0047] A first unknown protocol classification module is used to preliminarily classify unknown protocol data A in the network environment traffic data according to the N classification model of the known category data;

[0048] M classification model building module, used for building M classification model for the known category data and the unknown protocol data A, M=N+1;

[0049] A second unknown protocol classification module, used to classify unknown protocol data B from network environment traffic data according to the M classification model;

[0050] An N classification model updating module, used for updating the N classification model according to the unknown protocol data A and the unknown protocol data B;

[0051] The final M classification model construction module is used to repeatedly execute the first unknown protocol classification module, the M classification model construction module, the second unknown protocol classification module and the N classification model update module until the data volume of the unknown protocol data set is less than a threshold, and output the number of categories of the unknown protocol and the final M classification model;

[0052] The network traffic data classification module is used to classify unknown protocols in the network traffic data through the final M classification model.

[0053] Optionally, the N classification model building module includes the following functions:

[0054] The known category data is divided into a training set and a validation set according to a certain ratio;

[0055] Cross-validation: input the training set and obtain a model for classifying the known category data through ensemble learning algorithm training;

[0056] The model parameters are adjusted to prevent underfitting and overfitting, and the N classification model is obtained.

[0057] Optionally, the first unknown protocol classification module specifically includes the following functions:

[0058] Input a known category data set, classify it through N classification models, and get the prediction value of each weak classifier in the ensemble learning {T 1,T 2 ,T 3 ,..,T n};

[0059] Input the network data set obtained in a specific environment, classify it through the N classification model, and obtain the prediction value of each weak classifier in the ensemble learning {T 1 ,T 2 ,T 3 ,..,T n};

[0060] According to the characteristics of the predicted value of each weak classifier, the predicted value is discretized, and finally a feature vector {W 1 ,W 2 ,W 3 ,..,W n};

[0061] The vector {W 1 ,W 2 ,W 3 ,..,W n}The new features of the training data are input into the clustering model, and the network dataset obtained under a specific environment is preliminarily divided into an unknown protocol dataset and a known protocol dataset.

[0062] Optionally, the first unknown protocol classification module converts the vector {W 1 ,W 2 ,W 3 ,..,W n} is used as a new feature of the training data to input the clustering model, and the network data set obtained in a specific environment is preliminarily divided into an unknown protocol data set and a known protocol data set. Specifically:

[0063] Select a specific clustering algorithm, input labeled training data and network data obtained in a specific environment, build a clustering model to obtain clusters;

[0064] For each cluster obtained by classification, determine the number of samples of the known category data set and the total number of samples in the cluster, and further count the samples of the known category data set by category. If the samples of a certain category A account for the majority of the cluster, then the category of the cluster is defined as category A;

[0065] For the labeled training data set, the F1 value is calculated. If the F1 value is less than the threshold value, steps S241-S243 are repeated until the F1 value is greater than the threshold value.

[0066] For the constructed clustering model, determine whether there are samples of the known category data set in the cluster. If not, output it as the unknown protocol data set A.

[0067] Optionally, the M classification model building module specifically includes the following functions:

[0068] Set the label of the unknown protocol dataset A to N+1;

[0069] Divide the known category dataset and the unknown protocol dataset A into a training set and a validation set;

[0070] Cross-validation: input a training set and use a machine learning algorithm to train a model that classifies the known category data.

[0071] The model parameters are adjusted to prevent underfitting and overfitting, and the M classification model is obtained.

[0072] Optionally, the second unknown protocol classification module specifically includes the following functions:

[0073] Input the network data set obtained in a specific environment and classify it through the M classification model;

[0074] The samples classified into the Mth class are synthesized into an unknown protocol dataset B.

[0075] Optionally, the N classification model updating module specifically includes the following functions:

[0076] Input unknown protocol dataset A and unknown protocol dataset B, take their intersection C, and set the label of the intersection C to N+1;

[0077] Input a known category dataset, combine it with dataset C to form a new known category dataset, and update N to N+1;

[0078] Divide the known category data set into a training set and a validation set, cross-validate, input the training set, and use the ensemble learning algorithm to train a model that can classify the known category data;

[0079] Adjust the model parameters to prevent underfitting and overfitting and obtain the final N-classification model.

[0080] On the other hand, the present invention further provides a computer device, comprising a processor and a memory, wherein the memory stores a computer program, and the computer program is loaded and executed by the processor to implement any one of the above-mentioned unknown protocol classification methods.

[0081] On the other hand, the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is loaded and executed by a processor to implement any of the above-mentioned unknown protocol classification methods.

[0082] The beneficial effects of the present invention are:

[0083] (1) The present invention comprehensively uses the results of supervised machine learning and unsupervised machine learning classification to improve the accuracy of unknown protocol labels.

[0084] (2) The present invention utilizes an integrated learning algorithm and a prediction value discretization method to transform the features used in unsupervised machine learning, thereby improving the effectiveness of repeated use of the unsupervised machine learning algorithm for classification.

[0085] (3) For the clustering results, the present invention first labels the class according to the label category corresponding to most of the samples in the classified class, then evaluates the clustering effect using the F1 value of N known samples, and optimizes the clustering effect using the existing label data. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 It is a schematic diagram of the unknown protocol classification method provided by an embodiment of the present invention;

[0087] Figure 2 is a flow chart of the learning phase of the unknown protocol classification method provided by an embodiment of the present invention;

[0088] Figure 3 It is a flow chart of the classification phase of the unknown protocol classification method provided by an embodiment of the present invention;

[0089] Figure 4 is a flow chart of an unsupervised clustering process according to an embodiment of the present invention;

[0090] Figure 5 It is a structural block diagram of an unknown protocol classification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0091] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0092] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making any creative work shall fall within the scope of protection of the present invention.

[0093] The rapid emergence of various applications on the Internet and the inability to accurately measure existing applications on the network have resulted in the inability to classify these applications through the sampling-training-recognition approach, which further leads to the difficulty in classifying unknown protocol traffic in the real Internet environment.

[0094] In order to solve the above technical problems, the following embodiments of the unknown protocol classification method, device, equipment and storage medium of the present invention are proposed.

[0095] Example 1

[0096] Reference Figure 1 ,like Figure 1 FIG. 1 is a flow chart of the unknown protocol classification method provided in this embodiment, and the method specifically includes the following steps:

[0097] Step S100: input a labeled data set, analyze the characteristics of the known category data, and build an N-classification model for the known category data.

[0098] The labeled data sets proposed in this embodiment are all extracted from network data traffic and include the following features:

[0099] Feature Category Feature Description Dimensionality Package direction The packet direction of the first 10 packets of the bidirectional flow 10 Packet size Packet size of the first 10 packets in bidirectional flow 10 Time interval The packet time interval of the first 10 packets of the bidirectional flow 10 Pack Quantity The total number of packets sent in a unidirectional flow 2 Number of bytes The total number of bytes sent in a unidirectional flow 2

[0100] Table 1 Dataset feature table

[0101] It should be noted that the labeled training data includes not only the above features but also the labels corresponding to the samples.

[0102] Specifically, step S100 includes the following sub-steps:

[0103] S110: Divide the known category data into a training set and a validation set according to a certain ratio.

[0104] S120: cross validation, input the training set, and obtain a model for classifying known category data through ensemble learning algorithm training;

[0105] S130: Adjust model parameters to prevent underfitting and overfitting, and obtain an N-classification model.

[0106] As an implementation method, this embodiment divides the known category data into a training set and a validation set in a ratio of 9:1. Then, through ten-fold cross validation, the training set is input, and a decision tree is established by using the random forest algorithm and the C4.5 algorithm to train a model for classifying the known category data. The F1 value is used as an evaluation index to adjust the model parameters to prevent underfitting and overfitting, and obtain an N classification model.

[0107] Step S200: Preliminarily classify the unknown protocol data A in the network environment traffic data according to the N classification model of the known category data. Figure 4 ,like Figure 4 Shown is a flow chart of the unsupervised clustering process of this embodiment.

[0108] Specifically, step S200 includes the following steps:

[0109] S210: Input a known category data set and classify it through N classification models to obtain the prediction value of each weak classifier in the ensemble learning {T 1 ,T 2 ,T 3 ,..,T n};

[0110] S220: Input the network data set obtained in a specific environment, classify it through N classification models, and obtain the prediction value {T 1 ,T 2 ,T 3 ,..,T n};

[0111] It should be noted that the specific environment here refers to the fact that the components of network traffic are fixed within a certain period of time.

[0112] S230: Discretize the predicted values ​​according to the characteristics of each weak classifier, and finally form a feature vector {W 1 ,W 2 ,W 3 ,..,W n};

[0113] As an implementation method, this embodiment uses the leaf node to which the predicted value of each decision tree in the random forest belongs as the standard for one-hot encoding, marks the leaf node to which the current sample to be classified i is successfully marked as 1, and marks the remaining leaf nodes as 0, to obtain a label vector W for the sample i .

[0114] S240: vector {W 1 ,W 2 ,W 3 ,..,W n}The new features of the training data are input into the clustering model, and the network dataset obtained under a specific environment is preliminarily divided into an unknown protocol dataset and a known protocol dataset.

[0115] As an implementation manner, step S240 specifically includes the following steps:

[0116] S241: Select a specific clustering algorithm, input labeled training data and network data obtained in a specific environment, build a clustering model to obtain clusters;

[0117] It should be noted that any clustering algorithm can be selected, and the optimal clustering algorithm can be selected according to the results obtained after parameter adjustment. In this embodiment, the DBSCAN algorithm is used, through which the optimal clustering of data can be obtained.

[0118] S242: for each cluster obtained by classification, determine the number of samples of the known category data set and the total number of samples in the cluster, and further count the samples of the known category data set by category. If samples of a certain known category A account for the majority of the cluster, the category of the cluster is defined as category A.

[0119] S243: For the labeled training data set, calculate the F1 value. If the F1 value is less than the threshold value, repeat steps S241-S243 until the F1 value is greater than the threshold value.

[0120] S244: For the constructed clustering model, determine whether there are samples of the known category data set in the cluster. If not, output it as the unknown protocol data set A.

[0121] Step S300: construct M classification models for known category data and unknown protocol data A, where M=N+1.

[0122] Specifically, step S300 includes the following steps:

[0123] S310: Setting the label of the unknown protocol data set A to N+1;

[0124] S320: dividing the known category data set and the unknown protocol data set A into a training set and a validation set;

[0125] S330: cross validation, inputting a training set, and training a model for classifying the known category data through a machine learning algorithm;

[0126] It should be noted that the machine learning algorithm can select any machine learning algorithm, and the optimal machine learning algorithm can be selected according to the results obtained after parameter adjustment. The LightGBM algorithm is used in this embodiment, and the optimal classification model can be obtained through this algorithm.

[0127] S340: Adjust model parameters to prevent underfitting and overfitting, and obtain the M classification model.

[0128] Step S400: Classify unknown protocol data B from network environment traffic data according to the M classification model.

[0129] Specifically, step S400 includes the following steps:

[0130] S410: inputting a network data set obtained under a specific environment and classifying it through the M classification model;

[0131] S420: Synthesize the unknown protocol dataset B with the samples classified into the Mth category.

[0132] Step S500: Update the N classification model according to the unknown protocol data A and the unknown protocol data B.

[0133] Specifically, step S500 includes the following steps:

[0134] S510: input unknown protocol data set A and unknown protocol data set B, obtain their intersection C, and set the label of the intersection C to N+1;

[0135] S520: input a known category data set, combine it with data set C to form a new known category data set, and update N to N+1;

[0136] S530: Divide the known category data set into a training set and a validation set, perform cross-validation, input the training set, and train a model for classifying the known category data through an ensemble learning algorithm;

[0137] As an implementation method, in this embodiment, a training set is input, and a decision tree is established using a random forest algorithm and a C4.5 algorithm to train a model for classifying known category data.

[0138] S540: Adjust model parameters to prevent underfitting and overfitting, and obtain the final N-classification model.

[0139] Step S600: If the data volume of the unknown protocol data set is greater than the threshold, repeat steps S200-S500 until the data volume of the unknown protocol data set is less than the threshold, and output the number of categories of the unknown protocol and the final M classification model; if the data volume of the unknown protocol data set is less than the threshold, directly output the number of categories of the unknown protocol and the final M classification model.

[0140] Among them, steps S100-S600 are the learning stage of the unknown protocol classification method provided by this embodiment, and the learning stage is performed offline to build a model required for unknown protocol classification. Figure 2 ,like Figure 2 The figure is a flow chart of the learning phase of the unknown protocol classification method provided by this embodiment. It is usually assumed that in a specific environment, the components of network traffic are fixed within a certain period of time, so the number of unknown protocol categories and the corresponding classification model can be used for unknown protocol classification in the specific environment.

[0141] Step S700: Classify unknown protocols in the network traffic data using the final M classification model.

[0142] Specifically, the classification model obtained in the learning phase is deployed on the network nodes in a specific environment. The input is the network traffic collected in real time. After feature extraction, it is calculated by the classification model, and the output is the category corresponding to the sample.

[0143] As an implementation method, after classifying the traffic into various unknown category data sets, the traffic can be further refined and identified through methods such as data mining and protocol format reversal.

[0144] Wherein, step S700 is the classification stage of the unknown protocol classification method provided in this embodiment, which is used to classify the unknown protocols in the network traffic. Figure 3 ,like Figure 3 The figure is a flow chart of the classification phase of the unknown protocol classification method provided in this embodiment.

[0145] The unknown protocol classification method provided in this embodiment uses the results of supervised machine learning and unsupervised machine learning classification to improve the accuracy of unknown protocol labels. The unknown protocol classification method provided in this embodiment transforms the features used in unsupervised machine learning by using an ensemble learning algorithm and a discretization method of predicted values, thereby improving the effectiveness of repeated classification using unsupervised machine learning algorithms. The unknown protocol classification method provided in this embodiment, for the clustering results, first labels the class according to the label category corresponding to most of the samples in the classified class, then uses the F1 value of N known samples to evaluate the clustering effect, and uses the existing label data to optimize the clustering effect.

[0146] Example 2

[0147] Reference Figure 5 ,like Figure 5 FIG. 1 is a structural block diagram of an unknown protocol classification device provided in this embodiment, and the device specifically includes:

[0148] N-classification model building module 10, used for inputting labeled data sets, analyzing the characteristics of known category data, and building an N-classification model for known category data;

[0149] A first unknown protocol classification module 20, used to preliminarily classify unknown protocol data A in network environment traffic data according to an N classification model of known category data;

[0150] M classification model building module 30, used to build M classification model for known category data and unknown protocol data A, M = N + 1;

[0151] A second unknown protocol classification module 40, used to classify unknown protocol data B from network environment traffic data according to the M classification model;

[0152] N classification model updating module 50, used to update the N classification model according to unknown protocol data A and unknown protocol data B;

[0153] The final M classification model construction module 60 is used to repeatedly execute the first unknown protocol classification module 20, the M classification model construction module 30, the second unknown protocol classification module 40 and the N classification model update module 50 until the data volume of the unknown protocol data set is less than a threshold value, and output the number of categories of the unknown protocol and the final M classification model;

[0154] The network traffic data classification module 70 is used to classify unknown protocols in the network traffic data through the final M classification model.

[0155] As an implementation, the N-classification model building module 10 includes the following functions:

[0156] Divide the known category data into training set and validation set according to a certain ratio;

[0157] Cross-validation: input the training set and use the ensemble learning algorithm to train a model that can classify known category data.

[0158] The model parameters are adjusted to prevent underfitting and overfitting, and an N-classification model is obtained.

[0159] As an implementation manner, the first unknown protocol classification module 20 specifically includes the following functions:

[0160] Input a known category data set, classify it through N classification models, and get the prediction value of each weak classifier in the ensemble learning {T 1 ,T 2 ,T 3 ,..,T n};

[0161] Input the network data set obtained in a specific environment, classify it through the N classification model, and obtain the prediction value of each weak classifier in the ensemble learning {T 1 ,T 2 ,T 3 ,..,T n};

[0162] According to the characteristics of the predicted value of each weak classifier, the predicted value is discretized, and finally a feature vector {W 1 ,W 2 ,W 3 ,..,W n};

[0163] The vector {W 1 ,W 2 ,W 3,..,W n}The new features of the training data are input into the clustering model, and the network dataset obtained under a specific environment is preliminarily divided into an unknown protocol dataset and a known protocol dataset.

[0164] As an implementation method, the first unknown protocol classification module 20 converts the vector {W 1 ,W 2 ,W 3 ,..,W n} is used as a new feature of the training data to input the clustering model, and the network data set obtained in a specific environment is preliminarily divided into an unknown protocol data set and a known protocol data set. Specifically:

[0165] Select a specific clustering algorithm, input labeled training data and network data obtained in a specific environment, build a clustering model to obtain clusters;

[0166] For each cluster obtained by classification, determine the number of samples of the known category data set and the total number of samples in the cluster, and further count the samples of the known category data set by category. If the samples of a certain category A account for the majority of the cluster, then the category of the cluster is defined as category A;

[0167] For the labeled training data set, the F1 value is calculated. If the F1 value is less than the threshold value, steps S241-S243 are repeated until the F1 value is greater than the threshold value.

[0168] For the constructed clustering model, determine whether there are samples of the known category data set in the cluster. If not, output it as the unknown protocol data set A.

[0169] As an implementation method, the M classification model building module 30 specifically includes the following functions:

[0170] Set the label of the unknown protocol dataset A to N+1;

[0171] Divide the known category dataset and the unknown protocol dataset A into a training set and a validation set;

[0172] Cross-validation: input the training set and use the machine learning algorithm to train a model that can classify known category data;

[0173] Adjust the model parameters to prevent underfitting and overfitting and obtain the M classification model.

[0174] As an implementation manner, the second unknown protocol classification module 40 specifically includes the following functions:

[0175] Input the network data set obtained in a specific environment and classify it through the M classification model;

[0176] The samples classified into the Mth class are synthesized into an unknown protocol dataset B.

[0177] As an implementation method, the N classification model updating module 50 specifically includes the following functions:

[0178] Input unknown protocol dataset A and unknown protocol dataset B, take their intersection C, and set the label of the intersection C to N+1;

[0179] Input a known category dataset, combine it with dataset C to form a new known category dataset, and update N to N+1;

[0180] Divide the known category data set into a training set and a validation set, cross-validate, input the training set, and use the ensemble learning algorithm to train a model that can classify the known category data;

[0181] Adjust the model parameters to prevent underfitting and overfitting and obtain the final N-classification model.

[0182] The unknown protocol classification device provided in this embodiment uses the results of supervised machine learning and unsupervised machine learning classification to improve the accuracy of unknown protocol labels. The unknown protocol classification device provided in this embodiment transforms the features used in unsupervised machine learning by using an integrated learning algorithm and a discretization method for predicted values, thereby improving the effectiveness of repeated classification using unsupervised machine learning algorithms. The unknown protocol classification device provided in this embodiment, for the clustering results, first labels the class according to the label category corresponding to most of the samples in the classified class, then uses the F1 value of N known samples to evaluate the clustering effect, and uses the existing label data to optimize the clustering effect.

[0183] Example 3

[0184] This preferred embodiment provides a computer device, which can implement the steps in any embodiment of the unknown protocol classification method provided in the embodiments of the present application. Therefore, the beneficial effects of the unknown protocol classification method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0185] Example 4

[0186] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by controlling related hardware through instructions, and the instructions can be stored in a computer-readable storage medium and loaded and executed by a processor. To this end, an embodiment of the present invention provides a storage medium, which stores a plurality of instructions, and the instructions can be loaded by a processor to execute the steps of any embodiment of the unknown protocol classification method provided in the embodiment of the present invention.

[0187] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0188] Since the instructions stored in the storage medium can execute the steps in any unknown protocol classification method embodiment provided in the embodiments of the present invention, the beneficial effects that can be achieved by any unknown protocol classification method provided in the embodiments of the present invention can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0189] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for classifying unknown protocols, characterized in that: The method comprises: S100: inputting a labeled data set, analyzing the characteristics of known category data, and constructing an N-classification model of the known category data; S200: Preliminarily classifying unknown protocol data A in the network environment traffic data according to the N classification model of the known category data; The S200 specifically includes the following steps: S210: Input a known category data set and classify it through the N classification model to obtain the prediction value of each weak classifier in the ensemble learning {T1, T2, T3, .., T n }; S220: Input the network data set obtained in a specific environment, classify it through the N classification model, and obtain the prediction value {T1, T2, T3, .., T n }; S230: Discretize the predicted values ​​according to the characteristics of each weak classifier, and finally form a feature vector {W1, W2, W3, .., W n }; S240: transform the vector {W1,W2,W3,..,W n } Input the clustering model as the new features of the training data, and preliminarily divide the network data set obtained in a specific environment into an unknown protocol data set and a known protocol data set; The specific environment refers to that the components of network traffic are fixed within a certain period of time; S300: constructing M classification models for the known category data and the unknown protocol data A, where M=N+1; S400: Classifying unknown protocol data B from network environment traffic data according to the M classification model; S500: updating the N classification model according to the unknown protocol data A and the unknown protocol data B; S600: If the data volume of the unknown protocol data set is greater than the threshold, repeat steps S200-S500 until the data volume of the unknown protocol data set is less than the threshold, and output the number of categories of the unknown protocol and the final M classification model; if the data volume of the unknown protocol data set is less than the threshold, directly output the number of categories of the unknown protocol and the final M classification model; S700: Classifying unknown protocols in the network traffic data by using the final M classification model.

2. The unknown protocol classification method according to claim 1, characterized in that: The S100 specifically includes the following steps: S110: Dividing the known category data into a training set and a validation set according to a certain ratio; S120: cross validation, inputting a training set, and obtaining a model for classifying the known category data through ensemble learning algorithm training; S130: Adjust model parameters to prevent underfitting and overfitting, and obtain the N-classification model.

3. The unknown protocol classification method according to claim 1, characterized in that: The S240 specifically includes the following steps: S241: Select a specific clustering algorithm, input labeled training data and network data obtained in a specific environment, build a clustering model to obtain clusters; S242: for each cluster obtained by classification, determine the number of samples of the known category data set and the total number of samples in the cluster, and further count the samples of the known category data set by category. If samples of a certain known category A account for the majority of the cluster, the category of the cluster is defined as category A. S243: For the labeled training data set, calculate the F1 value. If the F1 value is less than the threshold value, repeat steps S241-S243 until the F1 value is greater than the threshold value. S244: For the constructed clustering model, determine whether there are samples of the known category data set in the cluster. If not, output it as the unknown protocol data set A.

4. The unknown protocol classification method according to claim 1, characterized in that: The S300 specifically includes the following steps: S310: Setting the label of the unknown protocol data set A to N+1; S320: dividing the known category data set and the unknown protocol data set A into a training set and a validation set; S330: cross validation, inputting a training set, and training a model for classifying the known category data through a machine learning algorithm; S340: Adjust model parameters to prevent underfitting and overfitting, and obtain the M classification model.

5. The unknown protocol classification method according to claim 1, characterized in that: The S400 specifically includes the following steps: S410: inputting a network data set obtained under a specific environment and classifying it through the M classification model; S420: Synthesize the unknown protocol dataset B with the samples classified into the Mth category.

6. The unknown protocol classification method according to claim 1, characterized in that: The S500 specifically includes the following steps: S510: input unknown protocol data set A and unknown protocol data set B, obtain their intersection C, and set the label of the intersection C to N+1; S520: input a known category data set, combine it with data set C to form a new known category data set, and update N to N+1; S530: Divide the known category data set into a training set and a validation set, perform cross-validation, input the training set, and train a model for classifying the known category data through an ensemble learning algorithm; S540: Adjust model parameters to prevent underfitting and overfitting, and obtain the final N-classification model.

7. An unknown protocol classification device, characterized in that: The device comprises: An N-classification model building module, used to input a labeled data set, analyze the characteristics of known category data, and build an N-classification model of the known category data; The first unknown protocol classification module is used to preliminarily classify the unknown protocol data A in the network environment traffic data according to the N classification model of the known category data, specifically including: Input a known category data set, classify it through the N classification model, and get the prediction value of each weak classifier in the ensemble learning {T1,T2,T3,..,T n }; Input the network data set obtained in a specific environment, classify it through the N classification model, and obtain the prediction value {T1,T2,T3,..,T n }; According to the characteristics of the prediction value of each weak classifier, the prediction value is discretized, and finally a feature vector {W1,W2,W3,..,W n }; The vector {W1,W2,W3,..,W n } Input the clustering model as the new features of the training data, and preliminarily divide the network data set obtained in a specific environment into an unknown protocol data set and a known protocol data set; The specific environment refers to that the components of network traffic are fixed within a certain period of time; M classification model building module, used for building M classification model for the known category data and the unknown protocol data A, M=N+1; A second unknown protocol classification module, used to classify unknown protocol data B from network environment traffic data according to the M classification model; An N classification model updating module, used for updating the N classification model according to the unknown protocol data A and the unknown protocol data B; The final M classification model construction module is used to repeatedly execute the first unknown protocol classification module, the M classification model construction module, the second unknown protocol classification module and the N classification model update module until the data volume of the unknown protocol data set is less than a threshold, and output the number of categories of the unknown protocol and the final M classification model; The network traffic data classification module is used to classify unknown protocols in the network traffic data through the final M classification model.

8. A computer device, characterized in that: The computer device includes a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the unknown protocol classification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which is loaded and executed by a processor to implement the unknown protocol classification method as described in any one of claims 1 to 6.

Images