A method and system for detecting unbalanced malicious traffic based on coarse-grained data tags

Abstract

This invention relates to a method and system for detecting unbalanced malicious traffic based on coarse-grained data labels. The method includes: S1: collecting malicious traffic data and normal traffic data at different time periods to construct a dataset, labeling each dataset with a coarse-grained label y, and labeling each data point x... i S2: Inherit the label y of its data set; i Multiple clustering algorithms were used to cluster malicious traffic data according to different sub-features, and the estimated score s was calculated. i S3: x i Dense vector representation of e i Input a multi-instance learning model and output each x. i The predicted value p i , using s i Construct a loss function to train a multi-instance learning model; S4: Based on p i Updates i When p i If the traffic is malicious, then increase the value by s. i The value is s, and vice versa. i The method provided by this invention only requires coarse-grained data labeling and utilizes estimated malicious data scores to achieve a malicious data prediction accuracy of the multi-instance learning model that approaches the performance of the supervised learning model with fine-grained data labeling.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method and system for detecting unbalanced malicious traffic based on coarse-grained data tags. Background Technology

[0002] Network traffic detection methods can generally be divided into two categories: rule-based and machine learning-based. Among rule-based methods, a popular approach is to use deep packet inspection (DPI) for traffic classification. For example, a scalable regular expression matching method can be used to convert the raw byte stream into a shorter integer stream, significantly improving the speed of DPI. The open-source tool nDPI is also very effective in many scenarios. It consists of a core library and plugin dissectors, offering rich protocol support and good extensibility. However, due to the diversification of attack methods and the increasing complexity of encrypted traffic, these rule-based methods struggle to capture the deep features of network traffic, thus limiting their detection capabilities. Machine learning-based detection techniques have a better ability to extract deep features from network traffic. For instance, researchers first designed a CNN structure using representation learning for malicious network traffic detection. This eliminates the need for manually designed features; the raw traffic is used directly as input, achieving excellent detection performance. Alternatively, a two-level anomaly detection system based on deep neural networks and association analysis has achieved high accuracy and low false positive rates on the NSL-KDD dataset, effectively combining association rules and neural networks. Alternatively, frequency domain features can be extracted to train deep learning models, improving detection accuracy and limiting the feature size, thus achieving faster detection speeds. However, most of these methods are based on supervised learning, which requires a large amount of data with accurate labels. In real-world production environments, this is extremely labor-intensive. Furthermore, network traffic exhibits severe class imbalance, meaning that malicious traffic typically constitutes only a small portion of network traffic, further complicating the development of an accurate traffic detection model.

[0003] Therefore, with minimal manual labeling, how to obtain an accurate malicious traffic detection model in the face of imbalanced network traffic has become an urgent problem to be solved. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method and system for detecting unbalanced malicious traffic based on coarse-grained data tags.

[0005] The technical solution of this invention is: a method for detecting unbalanced malicious traffic based on coarse-grained data tags, comprising:

[0006] Step S1: Collect malicious traffic data and normal traffic data at different time periods, construct data sets according to different time periods, and label each data set with a coarse-grained label y, and each data x i x inherits the label y of its respective dataset and obtains x i The tag y i Where y∈Y, y i ∈Y, where Y has N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label;

[0007] Step S2: Transfer data x i After the different sub-features are embedded and encoded, a dense vector representation e is obtained. i Multiple clustering algorithms are used to cluster data according to the aforementioned sub-features, and the estimated score s for each data point with a malicious data label is calculated. i ;

[0008] Step S3: e i Input a multi-instance learning model and output each x. i The corresponding predicted value p i and using s i Construct a loss function to train the multi-instance learning model;

[0009] Step S4: When the multi-instance learning model is in training mode, based on the predicted value p i Updates i That is, p i If the traffic is malicious, then increase the value by s. i The value is s, and vice versa. i Value; when the multi-instance learning model is in prediction mode, according to p i The value will trigger an early warning.

[0010] Compared with the prior art, the present invention has the following advantages:

[0011] This invention discloses an imbalanced malicious traffic detection method based on coarse-grained data labeling. It only requires simple manual coarse-grained data labeling to apply existing deep learning detection technology to the actual production environment. Furthermore, it uses a method of estimating malicious traffic scores to ensure that, under coarse-grained labeling, the multi-instance learning model can still pay more attention to the malicious traffic data that accounts for only a small proportion when faced with imbalanced network traffic data. This results in an accuracy rate close to that of a supervised learning model using fine-grained data labeling. Attached Figure Description

[0012] Figure 1 This is a flowchart of an unbalanced malicious traffic detection method based on coarse-grained data tags in an embodiment of the present invention;

[0013] Figure 2 This is a flowchart illustrating the method provided by the present invention in an embodiment of the present invention;

[0014] Figure 3 This is a schematic diagram of the estimated score calculation process in an embodiment of the present invention;

[0015] Figure 4 This is a graph showing the estimated score update calculation in an embodiment of the present invention;

[0016] Figure 5 This is a structural block diagram of an unbalanced malicious traffic detection system based on coarse-grained data tags, as described in an embodiment of the present invention. Detailed Implementation

[0017] This invention provides an imbalanced malicious traffic detection method based on coarse-grained data labeling. It only requires simple coarse-grained data labeling and uses the method of estimating malicious data scores to deal with the negative impact of class imbalance on the model. This makes the malicious data prediction accuracy of the multi-instance learning model close to that of the supervised learning model using fine-grained data labeling.

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below through specific implementations and in conjunction with the accompanying drawings.

[0019] Example 1

[0020] like Figure 1 As shown in the figure, an embodiment of the present invention provides a method for detecting unbalanced malicious traffic based on coarse-grained data tags, comprising the following steps:

[0021] Step S1: Collect malicious traffic data and normal traffic data at different time periods, construct datasets according to different time periods, and label each dataset with a coarse-grained label y and each data point x. i x inherits the label y of its respective dataset and obtains x i The tag y i Where y∈Y, y i ∈Y, where Y has N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label;

[0022] Step S2: Transfer data x i After the different sub-features are embedded and encoded, a dense vector representation e is obtained. i Multiple clustering algorithms are used to cluster data according to sub-features, and the estimated score s for each data point with a malicious data label is calculated. i ;

[0023] Step S3: e i Input a multi-instance learning model and output each x.i The corresponding predicted value p i and using s i Construct a loss function to train a multi-instance learning model;

[0024] Step S4: When the multi-instance learning model is in training mode, based on the predicted value p i Updates i That is, p i If the traffic is malicious, then increase the value by s. i The value is s, and vice versa. i Value; when the multi-instance learning model is in prediction mode, according to p i The value will trigger an early warning.

[0025] like Figure 2 The diagram shows a flowchart of the method provided by this invention. This method only requires experts to provide coarse-grained data labels in the time period dimension when capturing network traffic. The coarse-grained labeled data will obtain their respective maliciousness prediction scores after passing through the data pre-evaluation module, and then be input into a multi-instance learning model for training to calculate the predicted value of the maliciousness of the data. Finally, based on the prediction results of the network traffic by the multi-instance learning model, in training mode, the predicted score of the data is updated according to the predicted value of the data, and in prediction mode, an alarm signal and log record are issued.

[0026] In one embodiment, step S1 above involves collecting malicious traffic data and normal traffic data at different time periods, constructing data sets according to the different time periods, labeling each data set with a coarse-grained label y, and assigning a coarse-grained label x to each data set. i x inherits the label y of its respective dataset and obtains x i The tag y i Where y∈Y, y i ∈Y, where Y has N+1 category labels, the first N being malicious data labels and the N+1 being normal data labels, specifically including:

[0027] Step S11: Simulate malicious network attacks at different time periods to obtain malicious traffic data. At the same time, perform normal network operations in a secure network environment to obtain normal traffic data.

[0028] Deploy network traffic capture tools on server hosts within an organization or enterprise to simulate malicious network attacks that need to be prevented at different times, generate corresponding network traffic, and capture malicious data during that time period using the network traffic capture tool. At the same time, perform normal network operations in a secure network environment to generate corresponding network traffic, and capture normal traffic data during that time period using the network traffic capture tool.

[0029] Step S12: Merge malicious traffic data and normal traffic data from the same time period to construct a dataset for that time period. Label each dataset according to the categories of data it contains, obtaining its coarse-grained label y, and assign a coarse-grained label y to each data point x. i x inherits the label y of its respective dataset and obtains x i The tag y i Where y∈Y, y i ∈Y, where Y has N+1 category labels, the first N being malicious data labels and the N+1 being normal data labels.

[0030] Malicious traffic data and normal traffic data from the same time period are merged to construct a data set for that time period, such as... Figure 3 As shown, each box on the left represents a data set from a different time period. Each data set contains multiple data points, which may be a combination of malicious and normal data. Experts label each data set with coarse-grained tags based on the categories of the data it contains. For example, if the first data set contains category A malicious data, then the first data set is labeled as category A malicious, and so on, with coarse-grained tags applied to data sets from all time periods.

[0031] For each data point, the data inherits the coarse-grained label from its parent dataset. This can lead to situations where normal data is labeled as malicious. For example, all three normal data points in the first dataset might be labeled as Class A malicious data.

[0032] The embodiments of the present invention perform data labeling only on the time period dimension, which greatly reduces the labor costs for enterprises or organizations and significantly reduces the difficulty of manual data labeling.

[0033] In one embodiment, step S2 above: transfer data x i After the different sub-features are embedded and encoded, a dense vector representation e is obtained. i Multiple clustering algorithms are used to cluster data according to sub-features, and the estimated score s for each data point with a malicious data label is calculated. i Specifically, it includes:

[0034] Step S21: Place x i Projecting into the sub-feature space to extract x i Different sub-features are embedded and encoded to obtain a dense vector representation e. i ;

[0035] Data x iProjection into a sub-feature space can be achieved through operations such as filtering subsets of data fields or using dimensionality reduction algorithms. For example, if a dataset has subsets of fields A = {network protocol, request time point, request duration, number of requests, packet size} and B = {request source IP, request source port, destination IP, destination port, request source device}, then the data x... i Projecting onto A and B respectively, we obtain x. i Projected data x in two sub-feature spaces ai and x bi Discrete features (such as the request source IP) can be embedded and encoded using methods such as autoencoders to obtain their dense vector representation e. i , replacing its original value.

[0036] Step S22: Use a clustering algorithm to cluster x i Clustering is performed on a sub-feature to obtain different clusters. Each data point in each cluster retains its coarse-grained label y inherited from its parent dataset. i ;

[0037] Using a clustering algorithm (such as K-Means, DBSCAN, Mean Shift), perform clustering on data x. i Clustering is performed on projected data within a specific sub-feature space, such as... Figure 3 As shown, the K-Means algorithm is used to process data x in all datasets. i Clustering was performed, resulting in four clusters. Unlike standard clustering, the data x within each cluster... i It still inherits the coarse-grained label y that was marked in step S1. i ;

[0038] Step S23: In each cluster, calculate the proportion of each type of malicious data set as the estimated score of the malicious data category in that cluster. The estimated score of data with normal data category labels is recorded as 0.

[0039] After calculation, it can be obtained from Figure 3 The K-Means algorithm yields a predicted score of 0.22 for malicious category A and 0.22 for malicious category B in cluster 1; and so on, calculating the predicted score for each malicious data category within that cluster. Figure 3 As shown, the right side displays the predicted score obtained after each data point is clustered once based on a sub-feature;

[0040] Step S24: Repeat steps S22 to S23 using different clustering algorithms;

[0041] Step S25: Repeat steps S22 to S24 to cluster different sub-features and calculate the predicted scores;

[0042] Step S26: For each data point with a malicious data label, average the estimated scores obtained in each clustering process to obtain its final estimated score s. i .

[0043] In one embodiment, step S3 above: e i Input a multi-instance learning model and output each x. i The corresponding predicted value p i and using s i Constructing a loss function to train a multi-instance learning model includes:

[0044] Step S31: Obtain data x for the same time period i x i Corresponding coarse-grained label y i And predicted score s i ;

[0045] Step S32: Place x i The corresponding dense vector representation e i Inputting a multi-instance learning model, x is obtained through forward propagation of a neural network. i The predicted value p i ;

[0046] The multi-instance learning model of this invention can be constructed based on neural networks such as CNN and Transformer, with the number of neurons in the input layer and the density vector representation e. i The dimensions are consistent; the output layer has N+1 neurons and uses the softmax activation function, while other layers use the ReLU activation function; the input e i x is obtained through forward propagation calculation of a neural network. i The predicted value p i ;

[0047] Step S34: Calculate the loss value Loss predicted by the multi-instance learning model, as shown in formulas (1) to (2), and update the multi-instance learning model using the gradient descent algorithm so that it can fit the data distribution of normal network traffic and malicious network traffic.

[0048]

[0049]

[0050] in, Let y represent the cross-entropy loss function. i =y ne This represents the normal data label value, y. i ≠y neRepresented as a malicious data label value, λ is a hyperparameter used to control the importance of ① and ②;

[0051] The part ① in formula (1), that is, in formula (2) This indicates the data with the highest probability of being malicious traffic data among all data in the partition during that time period, as shown in (2). Its solution formula mainly consists of two parts, the first term For the model, the coarse-grained label y for this time period i Predictions for each data flow p i The cross-entropy loss represents the model's response to data x. i With coarse-grained label y i The degree of fit; the second term (1-s i The estimated score s is calculated by subtracting the estimated score of each flow data point from 1 in step S3. i The weighted value of that probability. The smaller the value, the more likely the data is malicious traffic. Divide this value by 1-s in ①. i To eliminate the impact of probability weighting on the cross-entropy loss of traffic data with the highest probability of malice. In formula (1), part ② represents the cross-entropy loss of traffic data other than the traffic data with the highest probability of malice within that time period partition. In formula (1), y... i ≠y ne The part represents the cross-entropy loss of the model for normal traffic data.

[0052] Based on the Loss calculated in formula (1), the weights of the multi-instance learning model are updated by the gradient descent algorithm, so that the model can gradually fit the data distribution of normal network traffic and malicious network traffic, and finally obtain the trained multi-instance learning model.

[0053] In one embodiment, step S4 above: when the multi-instance learning model is in training mode, based on the predicted value p i Updates i That is, p i If the traffic is malicious, then increase the value by s. i The value is s, and vice versa. i Value; when the multi-instance learning model is in prediction mode, according to p i The value will trigger an alert, specifically including:

[0054] Step S41: When the multi-instance learning model is in training mode: if x i The predicted value p i If formula (2) is satisfied, then s is updated using formula (3). i :

[0055]

[0056] Where k represents a data item that satisfies formula (2);

[0057] like Figure 4 As shown, the prediction score update calculation curve is displayed. Through formula (3), the malicious data under coarse-grained labeling gets a higher prediction score, while the normal data that is incorrectly labeled as malicious data gets a lower prediction score.

[0058] Step S42: When the multi-instance learning model is in prediction mode, i.e., the multi-instance learning model has been trained and can be used for the prediction of malicious data, detect if the prediction p on a certain malicious data category... i If the value is greater than the threshold, it indicates that a malicious network traffic attack has occurred within that time period, and an alert will be issued and written to the log.

[0059] The embodiments of the present invention design a method for estimating malicious traffic scores, ensuring that under coarse-grained labeling, the multi-instance learning model can still pay more attention to the malicious traffic data that accounts for only a small proportion, thereby achieving an accuracy close to that of a supervised learning model using fine-grained data labeling.

[0060] Example 2

[0061] like Figure 5 As shown, this embodiment of the invention provides an unbalanced malicious traffic detection system based on coarse-grained data tags, comprising the following modules:

[0062] The coarse-grained labeling module 51 is used to collect malicious traffic data and normal traffic data at different time periods, construct data sets according to different time periods, and label each data set with a coarse-grained label y, and each data x i x inherits the label y of its respective dataset and obtains x i The tag y i Where y∈Y, y i ∈Y, where Y has N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label;

[0063] Data pre-evaluation module 52 is used to evaluate data x i After the different sub-features are embedded and encoded, a dense vector representation e is obtained. i Multiple clustering algorithms are used to cluster data according to sub-features, and the estimated score s for each data point with a malicious data label is calculated. i ;

[0064] Multi-instance learning model training module 53, used to train e i Input a multi-instance learning model and output each x. i The corresponding predicted value p i and using s iConstruct a loss function to train a multi-instance learning model;

[0065] Predicted score feedback module 54, when the multi-instance learning model is in training mode, based on the predicted value p i Updates i That is, p i If the traffic is malicious, then increase the value by s. i The value is s, and vice versa. i Value; when the multi-instance learning model is in prediction mode, according to p i The value will trigger an early warning.

[0066] The above embodiments are provided merely for the purpose of describing the present invention and are not intended to limit the scope of the invention. The scope of the invention is defined by the appended claims. Various equivalent substitutions and modifications made without departing from the spirit and principles of the invention should be covered within the scope of the invention.

Claims

1. A method for detecting unbalanced malicious traffic based on coarse-grained data tags, characterized in that, include: Step S1: Collect malicious traffic data and normal traffic data at different time periods, construct data sets according to different time periods, and label each data set with coarse-grained tags. Each data Inherit the labels of its data set ,get tags ;in , There are N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label, specifically including: Step S11: Simulate malicious network attacks at different time periods to obtain malicious traffic data. At the same time, perform normal network operations in a secure network environment to obtain normal traffic data. Step S12: Merge the malicious traffic data and the normal traffic data within the same time period to construct a data set for that time period. Label each data set according to the categories of data contained in the data set to obtain its coarse-grained label. And each data Inherit the labels of its data set ,get tags ;in , There are N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label; Step S2: Transfer the data After different sub-features are embedded and encoded, a dense vector representation is obtained. Multiple clustering algorithms are used to cluster data according to the aforementioned sub-features, and the estimated score for each data point with a malicious data label is calculated. Specifically, it includes: Step S21: Projecting to the sub-feature space to extract Different sub-features; after embedding and encoding the different sub-features, a dense vector representation is obtained. ; Step S22: Use a clustering algorithm to... Clustering is performed on one of the sub-features to obtain different clusters, and each data point in each cluster retains its coarse-grained label inherited from the dataset to which it belongs. ; Step S23: In each cluster, calculate the proportion of each type of malicious data set as the estimated score of the malicious data category in the cluster. The estimated score of data with normal data category labels is recorded as 0. Step S24: Repeat steps S22-S23 using different clustering algorithms; Step S25: Repeat steps S22 to S24 to cluster the different sub-features and calculate the predicted scores; Step S26: For each piece of data with a malicious data label, average the estimated scores obtained in each clustering process to obtain its final estimated score. ; Step S3: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] Input a multi-instance learning model and output various... Corresponding predicted value and utilize Constructing a loss function to train the multi-instance learning model specifically includes: Step S31: Obtain data for the same time period , Corresponding coarse-grained label and predicted score ; Step S32: The corresponding dense vector representation Input a multi-instance learning model, and obtain the result through forward propagation of a neural network. Predicted value ; Step S34: Using the loss value Loss predicted by the multi-instance learning model, as shown in formulas (1)~(2), update the multi-instance learning model through the gradient descent algorithm so that it can fit the data distribution of normal network traffic and malicious network traffic: Loss= (1) (2) in, Represents the cross-entropy loss function. This represents the normal data label value. This is represented as a malicious data label value, where λ is a hyperparameter. In formula (2) This indicates the data with the highest probability of being malicious traffic among all data within that time period partition. Step S4: When the multi-instance learning model is in training mode, based on the predicted value... renew ,Right now If it is malicious traffic, then increase... The value is positive, and vice versa. Value; when the multi-instance learning model is in prediction mode, according to The value will trigger an early warning.

2. The method for detecting unbalanced malicious traffic based on coarse-grained data tags according to claim 1, characterized in that, Step S4: When the multi-instance learning model is in training mode, based on the predicted value renew ,Right now If it is malicious traffic, then increase... The value is positive, and vice versa. Value; when the multi-instance learning model is in prediction mode, according to The value will trigger an alert, specifically including: Step S41: When the multi-instance learning model is in training mode: if Predicted value If formula (2) is satisfied, then formula (3) is used to update. : = (3) in, This represents the data items that satisfy formula (2); Step S42: When the multi-instance learning model is in prediction mode, it detects if the prediction on a certain malicious data category... If the value exceeds the threshold, an alert will be issued and written to the log.

3. An unbalanced malicious traffic detection system based on coarse-grained data tags, characterized in that, Includes the following modules: The coarse-grained labeling module is used to collect malicious traffic data and normal traffic data at different time periods, construct data sets according to different time periods, and label each data set with coarse-grained tags. Each data Inherit the labels of its data set ,get tags ;in , There are N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label, specifically including: Step S11: Simulate malicious network attacks at different time periods to obtain malicious traffic data. At the same time, perform normal network operations in a secure network environment to obtain normal traffic data. Step S12: Merge the malicious traffic data and the normal traffic data within the same time period to construct a data set for that time period. Label each data set according to the categories of data contained in the data set to obtain its coarse-grained label. And each data Inherit the labels of its data set ,get tags ;in , There are N+1 category labels, the first N are malicious data labels, and the N+1th is a normal data label; The data pre-evaluation module is used to evaluate the data. After different sub-features are embedded and encoded, a dense vector representation is obtained. Multiple clustering algorithms are used to cluster data according to the aforementioned sub-features, and the estimated score for each data point with a malicious data label is calculated. Specifically, it includes: Step S21: Projecting to the sub-feature space to extract Different sub-features; after embedding and encoding the different sub-features, a dense vector representation is obtained. ; Step S22: Use a clustering algorithm to... Clustering is performed on one of the sub-features to obtain different clusters, and each data point in each cluster retains its coarse-grained label inherited from the dataset to which it belongs. ; Step S23: In each cluster, calculate the proportion of each type of malicious data set as the estimated score of the malicious data category in the cluster. The estimated score of data with normal data category labels is recorded as 0. Step S24: Repeat steps S22-S23 using different clustering algorithms; Step S25: Repeat steps S22 to S24 to cluster the different sub-features and calculate the predicted scores; Step S26: For each piece of data with a malicious data label, average the estimated scores obtained in each clustering process to obtain its final estimated score. ; The multi-instance learning model training module is used to train the model. Input a multi-instance learning model and output various... Corresponding predicted value and utilize Constructing a loss function to train the multi-instance learning model specifically includes: Step S31: Obtain data for the same time period , Corresponding coarse-grained label and predicted score ; Step S32: The corresponding dense vector representation Input a multi-instance learning model, and obtain the result through forward propagation of a neural network. Predicted value ; Step S34: Using the loss value Loss predicted by the multi-instance learning model, as shown in formulas (1)~(2), update the multi-instance learning model through the gradient descent algorithm so that it can fit the data distribution of normal network traffic and malicious network traffic: Loss= (1) (2) in, Represents the cross-entropy loss function. This represents the normal data label value. This is represented as a malicious data label value, where λ is a hyperparameter. In formula (2) This indicates the data with the highest probability of being malicious traffic among all data within that time period partition. The predicted score feedback module, when the multi-instance learning model is in training mode, calculates the score based on the predicted value. renew ,Right now If it is malicious traffic, then increase... The value is positive, and vice versa. Value; when the multi-instance learning model is in prediction mode, according to The value will trigger an early warning.

Images