A network communication detection method, device, equipment and storage medium

Abstract

This application relates to a network communication detection method, apparatus, device, and storage medium. The method includes: acquiring source data and test data respectively; calculating neural network labels, geometric labels, and neighbor labels for unlabeled test data in the test data respectively; generating pseudo-labels for the unlabeled test data based on the neural network labels, geometric labels, and neighbor labels; constructing geometric graphs for the source data and the test data respectively by calling a geometric graph generation algorithm based on the source data and the test data after generating pseudo-labels; performing spatial matching of the geometric graphs of the source data and the test data using shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms; and performing network communication detection on the test data based on the geometric graph matching results. This application utilizes source data with relatively abundant data and knowledge to assist test data with scarce label data and knowledge for more accurate network communication detection.

Description

Technical Field

[0001] This application belongs to the field of network communication technology, and specifically relates to a network communication detection method, apparatus, device, and storage medium. Background Technology

[0002] With the advancement and widespread application of network technology, more and more applications are being realized based on the Internet or IoT devices. To ensure that network technology better serves people's needs, it is often necessary to detect and classify network communications. This includes distinguishing different types of network communications to select appropriate resource allocation schemes, or performing security checks on network communication data to differentiate between normal and abnormal data, thereby ensuring the security and reliability of network technology. Therefore, network communication detection is a very important technology.

[0003] In existing technologies, commonly used network communication detection methods mainly include the following:

[0004] I. Knowledge-Based Network Communication Detection Method: This method pre-constructs a knowledge base containing network communication knowledge features. For example, when network communication data exhibits a certain pattern or feature, it is identified as one type of communication data; conversely, when network communication data exhibits another pattern or feature, it is identified as another type of communication data. This method has the following drawbacks: First, it relies on a complete network communication knowledge base. Constructing such a knowledge base requires highly specialized expertise and is complex, time-consuming, and labor-intensive. Furthermore, this knowledge base does not keep pace with the times and needs continuous updating; otherwise, the method relying on this knowledge base will be unable to adapt to rapidly evolving network technologies and will gradually become outdated.

[0005] II. Machine Learning-Based Network Communication Detection Method; This method employs a machine learning model, trained on existing network communication detection datasets, to enable it to perform network communication detection. However, machine learning models require large-scale datasets for training. For scenarios such as the Internet of Things (IoT), where data acquisition is difficult, obtaining a fully labeled training dataset is challenging. Furthermore, manually labeling the dataset is time-consuming and costly.

[0006] III. Pseudo-label-based training mode: Considering the scarcity of labeled information in the test data of machine learning-based network communication detection methods, some existing methods employ a pseudo-labeling mode for unlabeled test data to fully utilize the information in the unlabeled data. However, existing pseudo-label-based training modes have the following drawbacks: First, they do not fully consider the geometric information in space, which can help the algorithm perform more accurate and detailed pseudo-label annotation; second, they assign pseudo-labels to unlabeled data in isolation, without considering the relationship between the assigned pseudo-labels and other labels, thus resulting in a loss of accuracy in the assigned pseudo-labels.

[0007] IV. Graph-Based Training Mode: When using data-rich information sources to assist test data with scarce information in network communication detection, some existing methods employ graph-based training modes, such as minimizing the difference between the graph vectors of the data source and the graph vectors of the test data. However, this training mode does not match the graph from a geometric perspective; therefore, without considering the geometric characteristics of the graph itself, the performance of this training mode will suffer. Summary of the Invention

[0008] This application provides a network communication detection method, apparatus, device, and storage medium, which aims to at least partially solve one of the aforementioned technical problems in the prior art.

[0009] To address the above problems, this application provides the following technical solution:

[0010] A network communication detection method, comprising:

[0011] The source data and the test data are acquired separately; the source data is data that has all communication category labels, and the test data includes a small portion of labeled test data with communication category labels and a large portion of unlabeled test data without communication category labels.

[0012] Calculate the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data respectively, and generate pseudo labels for the unlabeled test data based on the neural network label, geometric label, and neighbor label;

[0013] Based on the source data and the test data after generating pseudo-labels, the geometric graph generation algorithm is called to construct the geometric graphs of the source data and the test data respectively.

[0014] By combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms, spatial matching is performed on the geometric graphs of the source data and the data to be tested. Based on the geometric graph matching results, network communication detection is performed on the data to be tested.

[0015] The technical solution adopted in this application embodiment further includes: after acquiring the source data and the data to be tested respectively, it also includes:

[0016] A first feature extractor for the source data and a second feature extractor for the test data are constructed respectively. The source data and the test data are input into the first feature extractor and the second feature extractor respectively. The first feature extractor and the second feature extractor are used to map the source data and the test data into a common feature space, and the feature vector representations of the source data and the test data in the common feature space are output.

[0017] The technical solution adopted in this application embodiment further includes: calculating the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data respectively, and generating pseudo labels of the unlabeled test data based on the neural network label, geometric label, and neighbor label, including:

[0018] The feature vector representations of the source data and the data to be tested in the common feature space are input into the common classifier;

[0019] The common classifier is used to output a predicted label for each unlabeled data point in the test data, which is denoted as the neural network label.

[0020] The source data is merged with the labeled test data in the test data, and the mean vector of each communication category data in the merged data is calculated.

[0021] For each unlabeled test data, find the mean vector of the merged communication category data with the highest cosine similarity, and use the communication category as the geometric label of the unlabeled test data.

[0022] Determine whether the neural network label and geometric label of each unlabeled test data are consistent. If they are inconsistent, do not assign a pseudo-label to the unlabeled test data; if they are consistent,

[0023] The labels of the N nearest adjacent labeled test data points to the unlabeled test data are counted, and it is determined whether a majority consensus can be reached among these N adjacent labels. If a majority consensus cannot be reached, no pseudo-label is assigned to the unlabeled test data; if a majority consensus can be reached, ...

[0024] The labels that reach a majority consensus are recorded as the neighbor labels of the unlabeled test data, and it is determined whether the neighbor labels of the unlabeled test data are consistent with the neural network labels. If they are inconsistent, no pseudo-label is assigned to the unlabeled test data; if they are consistent,

[0025] The neural network labels are used as pseudo-labels for the unlabeled test data.

[0026] The technical solution adopted in this application embodiment further includes: the specific method of constructing geometric graphs of the source data and the test data after generating pseudo-labels by calling a geometric graph generation algorithm to respectively construct geometric graphs of the source data and the test data is as follows:

[0027] The data obtained by merging the source data, labeled test data, and labeled test data with pseudo-labels respectively are used as the input data for the geometry generation algorithm.

[0028] For each type of input data, calculate the mean vector for each communication category and label it as a node. The specific definition is in This represents the number of data vectors in the input data that belong to the i-th communication category. This represents the set of all data vectors in the input data that belong to the i-th communication category;

[0029] For each communication category of data, calculate its pairwise mean vector. and The Euclidean distance between them;

[0030] Using the mean vector of communication category data The Euclidean distance between each pair of mean vectors is used to construct the complete graph and its weighted adjacency matrix;

[0031] The weighted adjacency matrix is ​​vectorized, and the weighted adjacency matrix vector for each type of input data is output. The weighted adjacency matrix vector includes the weighted adjacency matrix vector of the source data geometry, the weighted adjacency matrix vector of the labeled test data geometry, and the weighted adjacency matrix vector of the geometry generated by merging the labeled test data and the test data with pseudo-labels.

[0032] The technical solution adopted in this application embodiment further includes: the spatial matching of the geometric graphs of the source data and the data to be tested by combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms includes:

[0033] The geometry preservation module is invoked to preserve the shape of the geometry. The shape preservation algorithm of the geometry preservation module specifically involves: labeling the weighted adjacency matrix vector of the source data geometry as class 1, and labeling the weighted adjacency matrix vector of the geometry of the labeled test data and the weighted adjacency matrix vector of the geometry generated by merging the labeled test data and the test data with pseudo-labels as class 0 respectively; inputting the weighted adjacency matrix vectors and their labels of the three types of geometry into the adversarial network, and outputting the loss value of the adversarial network as:

[0034]

[0035] In the above formula, D represents the adversarial network, and M... S M represents the weighted adjacency matrix vector of the source data geometry. TL M TL+PL The weighted adjacency matrix vectors represent the other two geometric graphs, and D(M) represents the predicted output value of the source of the weighted adjacency matrix after inputting the weighted adjacency matrix into the adversarial network; the geometry preservation module drives the feature extractor to maximize the network loss. Feature mapping is performed in a manner that prevents the adversarial network from distinguishing the source of the weighted adjacency matrix vector of the geometry, thereby preserving the shape of the geometry.

[0036] The technical solution adopted in this application embodiment further includes: the spatial matching of the geometric graphs of the source data and the data to be tested by combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms further includes:

[0037] Call the rotation prevention module and the symmetry prevention module respectively to prevent geometric mismatch caused by rotation and symmetry;

[0038] The rotation prevention algorithm of the rotation prevention module specifically involves: calculating the mean vector of each communication category data in both the source data and the labeled test data; and for each communication category, calculating the mean vector of that communication category data in the source data. The mean vector of the communication category in the test data. The cosine similarity between them is summed and denoted as L. r The specific definition is as follows:

[0039]

[0040] Calculate the final loss L R =KL r , where K is the total number of communication categories;

[0041] The anti-symmetry algorithm of the symmetry prevention module is as follows: Calculate the mean vector of all data in the source data and the test data respectively; calculate the Euclidean distance between the mean vector of the source data and the mean vector of the test data, and use the Euclidean distance as the loss value; the loss value is defined as follows:

[0042]

[0043] Where, n S ,n T x represents the total number of source data and the total number of test data, respectively. i x represents the data vector of the i-th source data. jThis represents the data vector of the j-th data to be tested.

[0044] The technical solution adopted in this application embodiment further includes: the spatial matching of the geometric graphs of the source data and the data to be tested by combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms further includes:

[0045] The node distribution preservation module is invoked to perform node matching on the geometry; the node matching algorithm of the node distribution preservation module is as follows:

[0046] The mean vector of the distribution vectors output by the common classifier for each communication category data in the source data is calculated, and its mathematical definition is as follows:

[0047]

[0048] In the above formula, C is the common classifier, f is the feature extractor, T is the temperature parameter used to smooth the distribution vector, and q (k) This represents the mean vector of the distribution vectors of the k-th class of source data output by the common classifier. This represents the number of data vectors belonging to the k-th class in the source data. This represents the set of data vectors belonging to the k-th class in the source data;

[0049] The distribution vector of each labeled test data point, output by the common classifier, is calculated as follows:

[0050]

[0051] This represents the set of data vectors containing labeled data to be tested. For each labeled data point, the cross-entropy loss between its distribution vector and the mean distribution vector of the source data in its communication category is calculated and averaged. Its mathematical representation is as follows:

[0052]

[0053] Where, n TL This indicates the number of labeled data points to be tested. This indicates the labels corresponding to the labeled data to be tested. Indicates the yth i The mean vector of the distribution vectors output by the common classifier for the source data;

[0054] The label information of the labeled test data is used as auxiliary supervision, and the loss is defined as follows:

[0055]

[0056] in The cross-entropy loss is α, which is a trade-off parameter.

[0057] The label information of the source data is used as training supervision, and its mathematical definition is as follows:

[0058]

[0059] These are the data vector sets of the source data and the labels of the source data, respectively.

[0060] The final loss of the node matching algorithm is:

[0061]

[0062] In the above formula, γ, η, λ are weighting parameters used to adjust different loss terms, and E S E T These are the first feature extractor and the second feature extractor, respectively.

[0063] Another technical solution adopted in this application embodiment is: a network communication detection device, comprising:

[0064] Data acquisition module: used to acquire source data and test data respectively; the source data is data with complete communication category labels, and the test data includes a small portion of labeled test data with communication category labels and a majority of unlabeled test data without communication category labels;

[0065] The pseudo-label generation module is used to calculate the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data respectively, and generate pseudo-labels for the unlabeled test data based on the neural network label, geometric label, and neighbor label;

[0066] The geometry generation module is used to construct geometry graphs of the source data and the test data after generating pseudo-labels by calling the geometry generation algorithm.

[0067] The geometry matching module is used to perform spatial matching of the geometry of the source data and the data to be tested by combining shape preservation, rotation prevention, symmetry prevention and node distribution preservation algorithms, and to perform network communication detection on the data to be tested based on the geometry matching results.

[0068] Another technical solution adopted in this application embodiment is: a device, the device including a processor and a memory coupled to the processor, wherein,

[0069] The memory stores program instructions for implementing the network communication detection method;

[0070] The processor is used to execute the program instructions stored in the memory to control network communication detection.

[0071] Another technical solution adopted in this application embodiment is: a storage medium storing processor-executable program instructions, the program instructions being used to execute the network communication detection method.

[0072] Compared to existing technologies, the beneficial effects of the embodiments of this application are as follows: The network communication detection method, apparatus, device, and storage medium of the embodiments of this application acquire source data with complete communication category labels and test data with only partial communication category labels. Based on the source data and partially labeled test data, pseudo-labels for unlabeled test data are generated by comprehensively considering three types of information: neural network prediction, spatial geometric information, and neighbor information. After generating pseudo-labels, geometric graphs are constructed for both the source data and the test data from the perspective of spatial geometric graph matching. Finally, shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms are used to perform spatial matching of the geometric graphs of the source data and the test data. Based on the geometric graph matching results, network communication detection knowledge is transmitted from the source data to the test data, and network communication detection is performed on the test data. Compared to existing technologies, the embodiments of this application have at least the following beneficial effects:

[0073] 1. By acquiring source data with relatively abundant data and knowledge, we can assist test data with scarce label data and knowledge in conducting more accurate network communication detection, thus solving the problem of insufficient label data and knowledge in existing technologies and the difficulties it brings to network communication detection technology.

[0074] 2. When generating pseudo-labels for the test data, by comprehensively considering three types of information—neural network prediction, spatial geometric information, and neighbor information—pseudo-labels can be generated. This can avoid pseudo-labels that are relatively certain in prediction but conflict with geometric properties or are vague near the decision boundary, thereby improving the accuracy of pseudo-labels.

[0075] 3. When performing geometric graph matching, this application takes a geometric perspective and combines four geometric graph matching algorithms: geometric shape preservation, rotation prevention, symmetry prevention, and node distribution preservation. While maintaining the shape of the geometric graph, it avoids geometric graph mismatch caused by rotation and symmetry. It also performs node-level matching of the geometric graph from the perspective of the geometric graph nodes, forming a complete geometric graph matching algorithm from the whole to the part. This allows for more refined matching of the geometric graph, so that the source data can better assist the data under test in more accurate network communication detection. Attached Figure Description

[0076] Figure 1 This is a flowchart of the network communication detection method according to the first embodiment of this application;

[0077] Figure 2This is a flowchart of the network communication detection method according to the second embodiment of this application;

[0078] Figure 3 This is a schematic diagram illustrating the pseudo-label generation process based on a common classifier implemented in this application;

[0079] Figure 4 This is a flowchart of the geometry generation module algorithm in an embodiment of this application;

[0080] Figure 5 This is a schematic diagram of the geometric matching algorithm according to an embodiment of this application;

[0081] Figure 6 This is a flowchart of the geometry preservation module algorithm in an embodiment of this application;

[0082] Figure 7 This is a flowchart of the rotation placement module algorithm in an embodiment of this application;

[0083] Figure 8 This is a schematic diagram of the anti-symmetry algorithm of the symmetry prevention module in an embodiment of this application;

[0084] Figure 9 This is a flowchart of the node distribution maintenance module algorithm in an embodiment of this application;

[0085] Figure 10 This is a schematic diagram of the network communication detection device according to an embodiment of this application;

[0086] Figure 11 This is a schematic diagram of the device structure according to an embodiment of this application;

[0087] Figure 12 This is a schematic diagram of the structure of the storage medium according to an embodiment of this application. Detailed Implementation

[0088] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0089] Please see Figure 1 This is a flowchart of a network communication detection method according to a first embodiment of this application. The network communication detection method according to the first embodiment of this application includes the following steps:

[0090] S100: Acquire source data and test data respectively; the source data is data that has complete communication category labels, and the test data includes a small portion of labeled test data with communication category labels and a large portion of unlabeled test data without communication category labels.

[0091] S110: Calculate the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data respectively, and generate pseudo labels for the unlabeled test data based on the neural network label, geometric label, and neighbor label;

[0092] S120: Based on the source data and the test data after generating pseudo-labels, call the geometric graph generation algorithm to construct geometric graphs of the source data and the test data respectively;

[0093] S130: Combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms, spatial matching is performed on the geometric graphs of the source data and the data to be tested. Based on the geometric graph matching results, network communication detection is performed on the data to be tested.

[0094] The network communication detection method of the first embodiment of this application acquires source data with complete communication category labels and test data with only partial communication category labels. Based on the source data and partially labeled test data, pseudo-labels for the unlabeled test data are generated by comprehensively considering three types of information: neural network prediction, spatial geometric information, and neighbor information. After generating pseudo-labels, geometric graphs are constructed for both the source data and the test data from a spatial geometric graph matching perspective. Finally, shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms are used to perform spatial matching between the geometric graphs of the source data and the test data. Based on the geometric graph matching results, network communication detection knowledge is transferred from the source data to the test data, and network communication detection is performed on the test data. This embodiment of the application acquires source data with relatively abundant data and knowledge to assist test data with scarce label data and knowledge in performing more accurate network communication detection, solving the problem of insufficient label data and knowledge in the prior art and the difficulties it brings to network communication detection technology. 。

[0095] Please see Figure 2 This is a flowchart of a network communication detection method according to a second embodiment of this application. The network communication detection method according to the second embodiment of this application includes the following steps:

[0096] S200: Acquire source data with complete communication category labels and test data with only partial communication category labels respectively;

[0097] In this step, to address the problem of scarce tag data and knowledge in existing technologies, this invention uses a network communication scenario with relatively abundant data and knowledge as the data source to assist test data with scarce tag data and knowledge in more accurate network communication detection. The source data consists of communication data with complete communication category tags, while the test data includes a small portion of tagged test data with communication category tags and the vast majority of untagged test data without communication category tags. For example, in some network communication detections, data center networks can serve as a data source with abundant data, while IoT devices are test subjects with relatively scarce tag data and knowledge. Data center networks can be used as the information source to assist IoT devices with scarce tag data and knowledge in network communication detection. In other network communication detections, IoT devices can be used as the data source, and data center networks as the test subject, making this invention general and practical. This invention can be applied to test data with extremely limited tags, such as a tag ratio of 1:100, or even more extreme tag ratios.

[0098] S210: Construct a first feature extractor for the source data and a second feature extractor for the test data respectively. Input the source data and the test data into the first feature extractor and the second feature extractor respectively. Use the first feature extractor and the second feature extractor to map the source data and the test data into a common feature space, and output the feature vector representation of the source data and the test data in the common feature space.

[0099] In this step, the source data and the data to be tested are typically highly heterogeneous. For example, they may have different feature spaces, use different dimensional feature representations, and follow different distributions. Therefore, to transfer the communication detection knowledge from the source data to assist the data to be tested in more accurate communication detection, it is necessary to map the source data and the data to be tested so that they reside in a common feature space. Based on this, this embodiment constructs a first feature extractor and a second feature extractor for the source data and the data to be tested, respectively. The first feature extractor and the second feature extractor are each a two-layer fully connected neural network using ReLU or LeakyReLU as activation functions. Then, the source data and the data to be tested are input into the first feature extractor and the second feature extractor, respectively. The first feature extractor and the second feature extractor are used to map the source data and the data to be tested into a common feature space, thereby obtaining the feature vector representations of the source data and the data to be tested in the common feature space.

[0100] S220: Input the feature vector representations of the source data and the test data in the common feature space into the common classifier, and use the common classifier to predict and generate pseudo labels for each unlabeled test data.

[0101] In this step, the common classifier is a one-layer fully connected neural network using ReLU or LeakyReLU as the activation function. Specifically... Figure 3 The diagram illustrates the pseudo-label generation process based on a common classifier implemented in this application, which specifically includes the following steps:

[0102] S221: Use a common classifier to output a predicted label for each unlabeled test data, denoted as the neural network label;

[0103] S222: Merge the source data with the labeled test data, and calculate the mean vector of each communication category data in the merged data, denoted as... It represents the mean vector of all k-th communication category data in the merged data, and S+TL represents the merging of the source data and the labeled test data.

[0104] S223: For each unlabeled data point to be tested, find the mean vector of the merged communication category data that has the highest cosine similarity to it, and use this communication category as the geometric label of the unlabeled data point to be tested; the geometric label calculation formula is as follows:

[0105]

[0106] In formula (1), This represents the geometric label of the i-th unlabeled test data. This represents the data vector of the i-th unlabeled test data.

[0107] S224: Determine whether the neural network label and geometric label of each unlabeled test data are consistent. If they are inconsistent, proceed to S225; if they are consistent, proceed to S226.

[0108] S225: Do not assign a pseudo-label to the unlabeled test data;

[0109] S226: For each unlabeled test data, count the labels of the N nearest labeled test data that are adjacent to the unlabeled test data, and determine whether the N adjacent labels can reach a majority consensus in the form of majority rule. If a majority consensus cannot be reached, execute S225; if a majority consensus can be reached, execute S227.

[0110] S227: Record the label that has reached a majority consensus as the neighbor label, and determine whether the neighbor label is consistent with the neural network label of the unlabeled test data. If they are inconsistent, execute S225; if they are consistent, execute S228.

[0111] S228: Use the neural network label as the pseudo-label for the unlabeled test data.

[0112] In summary, this invention comprehensively considers neural network predicted labels, geometric labels, and neighbor labels when generating pseudo-labels. Geometric labels can better take into account the geometric relationships of communication data in space, enabling more accurate and detailed pseudo-label generation. Neighbor labels avoid isolated pseudo-label generation, thus better avoiding some ambiguous and error-prone pseudo-labels through neighbor information. For example, it avoids assigning pseudo-labels to unlabeled test data near the decision boundary, preventing a loss of accuracy in the assigned pseudo-labels. By comprehensively considering neural network prediction, spatial geometric information, and neighbor information to generate pseudo-labels, it avoids pseudo-labels that are relatively certain but conflict with geometric properties or are ambiguous near the decision boundary, thereby improving the accuracy of pseudo-labels.

[0113] S230: Based on the source data and the test data after generating pseudo-labels, from the perspective of spatial geometric graph matching, the geometric graph generation module is called to construct geometric graphs for the source data and the test data respectively;

[0114] In this step, after generating pseudo-labels for the unlabeled test data, the data is divided into four categories: fully labeled source data, partially labeled test data, partially unlabeled test data without pseudo-labels, and test data with pseudo-labels. When constructing the geometry of the source data and the test data, the geometry generation module is called three times. The first call uses the fully labeled source data as input; the second call uses the labeled test data as input; and the third call uses a combination of the labeled test data and the pseudo-labeled test data as input.

[0115] Specifically, such as Figure 4 The diagram shown is a flowchart of the geometry generation module algorithm according to an embodiment of this application, which specifically includes the following steps:

[0116] S231: For each type of input data, calculate the mean vector of each communication category and label it as a node. The specific definition is in This represents the number of data vectors in the input data that belong to the i-th communication category. This represents the set of all data vectors in the input data that belong to the i-th communication category;

[0117] S232: For each communication category of data, calculate its pairwise mean vector. and The Euclidean distance between them;

[0118] S233: Using the mean vector of communication category data The complete graph and its weighted adjacency matrix are constructed by the Euclidean distance between each pair of mean vectors; the dimension of the weighted adjacency matrix is ​​the total number of communication categories. For example, if there are a total of 6 communication categories, the weighted adjacency matrix is ​​a 6x6 matrix.

[0119] S234: Vectorize the weighted adjacency matrix (e.g., convert a 6x6 weighted adjacency matrix into a 1x36 dimension vector) and output the weighted adjacency matrix vector.

[0120] Based on the above, after completing three calls to the geometry generation module, three weighted adjacency matrix vectors of the geometry will be obtained based on different input data: the weighted adjacency matrix vector of the source data geometry, the weighted adjacency matrix vector of the geometry of the labeled test data, and the weighted adjacency matrix vector of the geometry generated by merging the labeled test data and the test data with pseudo-labels.

[0121] S240: Combining shape preservation, rotation prevention, symmetry prevention and node distribution preservation algorithms, spatial matching is performed on the geometric graphs of the source data and the data to be tested. Based on the geometric graph matching results, network communication detection knowledge is transmitted from the source data to the data to be tested, and network communication detection is performed on the data to be tested.

[0122] In this step, geometric graph matching is performed using a geometry shape preservation module, a rotation prevention module, a symmetry prevention module, and a node distribution preservation module. Specifically, from the perspective of the overall geometry, the geometry shape preservation module preserves the shape of the geometry. While preserving the shape, the rotation prevention module and the symmetry prevention module prevent geometric graph mismatches caused by rotation and symmetry, respectively. Furthermore, from the perspective of geometric graph nodes, the node distribution preservation module performs node-level matching. This application combines four geometric graph matching algorithms to form a complete geometric graph matching algorithm from a global to a local perspective, enabling more refined geometric graph matching. This allows the source data to better assist the test data in more accurate network communication detection.

[0123] Furthermore, such as Figure 5 The diagram shown is a schematic of the geometric graph matching algorithm according to an embodiment of this application. The algorithm employs shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms to perform spatial matching of the geometric graphs of the source data and the data to be tested. Specifically, it includes the following steps:

[0124] S241: Call the geometry preservation module to preserve the shape of the geometry;

[0125] Specifically, such as Figure 6The diagram shows the algorithm flowchart of the geometry preservation module in this application embodiment. Specifically, the geometry preservation module performs the following algorithm to preserve the shape of the geometry: The weighted adjacency matrix vector of the source data geometry is labeled as class 1, and the weighted adjacency matrix vectors of the latter two types of geometry (i.e., the weighted adjacency matrix vector of the geometry with labeled test data and the weighted adjacency matrix vector of the geometry generated by merging the labeled test data and the test data with pseudo-labels) are labeled as class 0. Then, the weighted adjacency matrix vectors of the three types of geometry and their labels are input into an adversarial network, and the loss value of the adversarial network is output. This adversarial network is a one-layer fully connected neural network used to distinguish whether the weighted adjacency matrix vectors of the three types of input geometry belong to class 1 or class 0. The loss value of the adversarial network is:

[0126]

[0127] In formula (2), D represents the adversarial network, M S M represents the weighted adjacency matrix vector of the source data geometry. TL N TL+PL D(M) represents the weighted adjacency matrix vector of the latter two geometries, and represents the predicted output value of the source of the weighted adjacency matrix after the weighted adjacency matrix is ​​input into the adversarial network.

[0128] The geometry preservation module drives the feature extractor to maximize the network loss. This method of feature mapping prevents adversarial networks from distinguishing the origin of the weighted adjacency matrix vectors of the geometric graph, thus preserving the geometric shape of the graph. Furthermore, it allows for better fusion of labeled test data and pseudo-labeled test data through geometric shape preservation.

[0129] S242: Call the rotation prevention module to prevent geometry mismatch caused by rotation;

[0130] Even while maintaining the geometric shape, geometric mismatches can still occur due to rotation or symmetry. Therefore, embodiments of this application utilize a rotation prevention module to avoid geometric mismatches caused by rotation. Specifically, as follows... Figure 7 The diagram shown is a flowchart of the rotation placement module algorithm according to an embodiment of this application. The rotation prevention algorithm specifically includes:

[0131] First, calculate the mean vector of each communication category in both the source data and the labeled test data; then, for each communication category, calculate the mean vector of that category in the source data. The mean vector of that category in the test data The cosine similarity between them is summed and denoted as L. r The specific definition is as follows:

[0132]

[0133] Finally, calculate the final loss L. R =KL r , where K is the total number of communication categories.

[0134] S243: Call the symmetry prevention module to prevent geometric mismatch caused by symmetry;

[0135] In addition to preventing geometric mismatch from the perspective of preventing rotation, this application also prevents geometric mismatch caused by symmetry from the perspective of preventing symmetry. Specifically, as follows... Figure 8 The diagram shown is a schematic of the anti-symmetry algorithm of the symmetry prevention module in this application embodiment. The algorithm specifically includes:

[0136] First, calculate the mean vectors of all data in both the source data and the test data. Then, calculate the Euclidean distance between the mean vectors of the source data and the test data, and use this Euclidean distance as the loss value. This loss value is defined as follows:

[0137]

[0138] Where, n S ,n T x represents the total number of source data and the total number of test data, respectively. i x represents the data vector of the i-th source data. j This represents the data vector of the j-th data to be tested.

[0139] S244: Invoke the node distribution preservation module to perform node matching on the geometry;

[0140] Among them, such as Figure 9 The diagram shown is a flowchart of the node distribution maintenance module algorithm according to an embodiment of this application. The algorithm specifically includes:

[0141] First, calculate the mean vector of the distribution vectors output by the common classifier for each communication category in the source data. Its mathematical definition is as follows:

[0142]

[0143] In formula (5), C is the common classifier, f is the feature extractor, T is the temperature parameter used to smooth the distribution vector, and q (k) This represents the mean vector of the distribution vectors of the k-th class of source data output by the common classifier. This represents the number of data vectors belonging to the k-th class in the source data. This represents the set of data vectors belonging to the k-th class in the source data.

[0144] Secondly, calculate the distribution vector of each labeled test data point output by the common classifier, which is defined as follows:

[0145]

[0146] in, This represents the set of labeled data vectors to be tested. Then, for each labeled data vector, the cross-entropy loss between its distribution vector and the mean distribution vector of the source data in its corresponding communication category is calculated and averaged. Its mathematical representation is as follows:

[0147]

[0148] Where, n TL This indicates the number of labeled data points to be tested. This indicates the labels corresponding to the labeled data to be tested. Indicates the yth i The source data is the mean vector of the distribution vectors output by the common classifier. Label information from the labeled test data can also provide supervision. The final loss is defined as follows:

[0149]

[0150] in α represents the cross-entropy loss, and α is a trade-off parameter.

[0151] The label information of the source data can also provide training supervision, and its mathematical definition is as follows:

[0152]

[0153] in, Let be the set of data vectors from the source data and the labels of the source data, respectively. Therefore, the final loss of the algorithm is:

[0154]

[0155] In formula (10), γ, η, and λ are weight parameters used to adjust different loss terms, and E S E T These are the first and second feature extractors, respectively. The algorithm continuously iterates and optimizes the network parameters until the loss converges. At this point, the source data, with its relatively rich knowledge, can be used to assist the test data, which has relatively scarce label data, in achieving more accurate network communication detection.

[0156] Based on the above, the network communication detection method of the second embodiment of this application acquires source data with complete communication category labels and test data with only partial communication category labels. Based on the source data and partially labeled test data, pseudo-labels for unlabeled test data are generated by comprehensively considering three types of information: neural network prediction, spatial geometric information, and neighbor information. After generating pseudo-labels, geometric graphs are constructed for both the source data and the test data from the perspective of spatial geometric graph matching. Finally, shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms are used to perform spatial matching of the geometric graphs of the source data and the test data. Based on the geometric graph matching results, network communication detection knowledge is transmitted from the source data to the test data, and network communication detection is performed on the test data. Compared with the prior art, the embodiments of this application have at least the following beneficial effects:

[0157] 1. By utilizing source data with relatively abundant data and knowledge to assist test data with scarce label data and knowledge, more accurate network communication detection is achieved. This solves the problem of insufficient label data and knowledge in existing technologies, as well as the performance degradation caused by data scarcity in existing methods.

[0158] 2. When generating pseudo-labels for the test data, by comprehensively considering three types of information—neural network prediction, spatial geometric information, and neighbor information—pseudo-labels can be generated. This can avoid pseudo-labels that are relatively certain in prediction but conflict with geometric properties or are vague near the decision boundary, thereby improving the accuracy of pseudo-labels.

[0159] 3. When performing geometric graph matching, this application takes a geometric perspective and combines four geometric graph matching algorithms: geometric shape preservation, rotation prevention, symmetry prevention, and node distribution preservation. While maintaining the shape of the geometric graph, it avoids geometric graph mismatch caused by rotation and symmetry. It also performs node-level matching of the geometric graph from the perspective of the geometric graph nodes, forming a complete geometric graph matching algorithm from the whole to the part. This allows for more refined matching of the geometric graph, so that the source data can better assist the data under test in more accurate network communication detection.

[0160] 4. This invention has universal applicability and can be used for various types of network communication detection, such as intrusion detection, security detection, and task detection.

[0161] 5. This invention is robust to the characteristics and distribution of source data and test data, and can be applied to source data and test data that are homogeneous or heterogeneous.

[0162] Please see Figure 10 This is a schematic diagram of the network communication detection device according to an embodiment of this application. The network communication detection device 40 according to an embodiment of this application includes:

[0163] Data acquisition module 41: used to acquire source data and test data respectively; the source data is data with complete communication category labels, and the test data includes a small portion of labeled test data with communication category labels and a large portion of unlabeled test data without communication category labels.

[0164] Pseudo-label generation module 42: used to calculate the neural network label, geometric label and neighbor label of the unlabeled test data in the test data respectively, and generate pseudo-labels for the unlabeled test data based on the neural network label, geometric label and neighbor label;

[0165] Geometric graph generation module 43: used to construct geometric graphs of the source data and the test data after generating pseudo-labels by calling a geometric graph generation algorithm.

[0166] Geometric graph matching module 44: used to perform spatial matching of the geometric graphs of the source data and the data to be tested by combining shape preservation, rotation prevention, symmetry prevention and node distribution preservation algorithms, and to perform network communication detection on the data to be tested based on the geometric graph matching results.

[0167] Please see Figure 11 This is a schematic diagram of the device structure according to an embodiment of this application. The device 50 includes a processor 51 and a memory 52 coupled to the processor 51.

[0168] The memory 52 stores program instructions for implementing the above-described network communication detection method.

[0169] The processor 51 is used to execute program instructions stored in the memory 52 to control network communication detection.

[0170] The processor 51 can also be referred to as a CPU (Central Processing Unit). The processor 51 may be an integrated circuit chip with signal processing capabilities. The processor 51 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor or any conventional processor.

[0171] Please see Figure 12This is a schematic diagram of the structure of the storage medium in an embodiment of this application. The storage medium in this embodiment stores a program file 61 capable of implementing all the above methods. This program file 61 can be stored in the storage medium in the form of a software product, including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, or devices such as computers, servers, mobile phones, and tablets.

[0172] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network communication detection method, characterized in that, include: The source data and the test data are acquired separately; the source data is data that has all communication category labels, and the test data includes a small portion of labeled test data with communication category labels and a large portion of unlabeled test data without communication category labels. Calculate the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data respectively, and generate pseudo labels for the unlabeled test data based on the neural network label, geometric label, and neighbor label; Based on the source data and the test data after generating pseudo-labels, the geometric graph generation algorithm is called to construct the geometric graphs of the source data and the test data respectively. By combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms, spatial matching is performed on the geometric graphs of the source data and the data to be tested. Based on the geometric graph matching results, network communication detection is performed on the data to be tested.

2. The network communication detection method of claim 1, wherein, After acquiring the source data and the data to be tested respectively, the process also includes: A first feature extractor for the source data and a second feature extractor for the test data are constructed respectively. The source data and the test data are input into the first feature extractor and the second feature extractor respectively. The first feature extractor and the second feature extractor are used to map the source data and the test data into a common feature space, and the feature vector representations of the source data and the test data in the common feature space are output.

3. The method of claim 2, wherein the network communication is a network packet. The step of calculating the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data, and generating pseudo labels for the unlabeled test data based on the neural network label, geometric label, and neighbor label includes: The feature vector representations of the source data and the data to be tested in the common feature space are input into the common classifier; The common classifier is used to output a predicted label for each unlabeled data point in the test data, which is denoted as the neural network label. The source data is merged with the labeled test data in the test data, and the mean vector of each communication category data in the merged data is calculated. For each unlabeled test data, find the mean vector of the merged communication category data with the highest cosine similarity, and use the communication category as the geometric label of the unlabeled test data. Determine whether the neural network label and geometric label of each unlabeled test data are consistent. If they are inconsistent, do not assign a pseudo-label to the unlabeled test data; if they are consistent, The labels of the N nearest adjacent labeled test data points to the unlabeled test data are counted, and it is determined whether a majority consensus can be reached among these N adjacent labels. If a majority consensus cannot be reached, no pseudo-label is assigned to the unlabeled test data; if a majority consensus can be reached, ... The labels that reach a majority consensus are recorded as the neighbor labels of the unlabeled test data, and it is determined whether the neighbor labels of the unlabeled test data are consistent with the neural network labels. If they are inconsistent, no pseudo-label is assigned to the unlabeled test data; if they are consistent, The neural network labels are used as pseudo-labels for the unlabeled test data.

4. The method of claim 1 to 3, wherein, The specific steps for constructing geometric graphs of the source data and the test data after generating pseudo-labels by calling a geometric graph generation algorithm are as follows: The data obtained by merging the source data, labeled test data, and labeled test data with pseudo-labels respectively are used as the input data for the geometry generation algorithm. For each type of input data, calculate the mean vector for each communication category and label it as a node. , The specific definition is ,in Indicates that the input data belongs to the first... i The number of data vectors for each communication category This indicates all data in the input that belong to the first... i A collection of data vectors for each communication category; For each communication category data, calculate the Euclidean distance between the pairwise mean vector and ; Mean vectors of communication category data and the Euclidean distance between each pair of mean vectors to construct a complete graph and its weighted adjacency matrix; The weighted adjacency matrix is ​​vectorized, and the weighted adjacency matrix vector for each type of input data is output. The weighted adjacency matrix vector includes the weighted adjacency matrix vector of the source data geometry, the weighted adjacency matrix vector of the labeled test data geometry, and the weighted adjacency matrix vector of the geometry generated by merging the labeled test data and the test data with pseudo-labels.

5. The method of claim 4, wherein the network communication is detected by: The spatial matching of the geometric graphs of the source data and the test data, which combines shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms, includes: The geometry preservation module is invoked to preserve the shape of the geometry. The shape preservation algorithm of the geometry preservation module specifically involves: labeling the weighted adjacency matrix vector of the source data geometry as class 1, and labeling the weighted adjacency matrix vector of the geometry of the labeled test data and the weighted adjacency matrix vector of the geometry generated by merging the labeled test data and the test data with pseudo-labels as class 0 respectively; inputting the weighted adjacency matrix vectors and their labels of the three types of geometry into the adversarial network, and outputting the loss value of the adversarial network as: In the above formula, D Represents adversarial networks, The weighted adjacency matrix vector representing the geometry of the source data. Represents the weighted adjacency matrix vectors of the other two geometric graphs. This represents the predicted output value for the source of the weighted adjacency matrix after inputting it into the adversarial network; the geometry preservation module drives the feature extractor to maximize the network loss. Feature mapping is performed in a manner that prevents the adversarial network from distinguishing the source of the weighted adjacency matrix vector of the geometry, thereby preserving the shape of the geometry.

6. The network communication detection method of claim 5, wherein, The spatial matching of the geometric graphs of the source data and the test data by combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms also includes: Call the rotation prevention module and the symmetry prevention module respectively to prevent geometric mismatch caused by rotation and symmetry; The rotation prevention algorithm of the rotation prevention module specifically involves: calculating the mean vector of each communication category data in both the source data and the labeled test data; and for each communication category, calculating the mean vector of that communication category data in the source data. The mean vector of the communication category in the test data. The cosine similarity between them is summed and denoted as . The specific definition is as follows: computing the final loss where K is the number of total communication categories; The anti-symmetry algorithm of the symmetry prevention module is as follows: Calculate the mean vector of all data in the source data and the test data respectively; calculate the Euclidean distance between the mean vector of the source data and the mean vector of the test data, and use the Euclidean distance as the loss value; the loss value is defined as follows: in, These represent the total number of source data and the total number of test data, respectively. Representing the i The data vector of each source data, Indicates the first j A data vector of data to be tested.

7. The method of claim 6, wherein the network communication is detected by: The spatial matching of the geometric graphs of the source data and the test data by combining shape preservation, rotation prevention, symmetry prevention, and node distribution preservation algorithms also includes: The node distribution preservation module is invoked to perform node matching on the geometry; the node matching algorithm of the node distribution preservation module is as follows: The mean vector of the distribution vectors output by the common classifier for each communication category data in the source data is calculated, and its mathematical definition is as follows: In the above formula, C For public classifiers, f For feature extractor, T The temperature parameter is used to smooth the distribution vector. Indicates the first k The source data is the mean vector of the distribution vectors output by the common classifier. This represents the number of data vectors belonging to the k-th class in the source data. This represents the set of data vectors belonging to the k-th class in the source data; The distribution vector of each labeled test data point, output by the common classifier, is calculated as follows: This represents the set of data vectors containing labeled data to be tested. For each labeled data point, the cross-entropy loss between its distribution vector and the mean distribution vector of the source data in its communication category is calculated and averaged. Its mathematical representation is as follows: in, This indicates the number of labeled data points to be tested. This indicates the labels corresponding to the labeled data to be tested. Indicates the first The mean vector of the distribution vectors output by the common classifier for the source data; The label information of the labeled test data is used as auxiliary supervision, and the loss is defined as follows: wherein is the cross-entropy loss, and a is a trade-off parameter. The label information of the source data is used as training supervision, and its mathematical definition is as follows: a data vector set of source data and a label of the source data, respectively; The final loss of the node matching algorithm is: In the above formula, are weight parameters for adjusting different loss terms, are a first feature extractor and a second feature extractor, respectively.

8. A network communication detection device, characterized in that, include: Data acquisition module: used to acquire source data and test data respectively; The source data consists of data that fully possesses communication category labels, and the test data includes a small portion of labeled test data with communication category labels and a majority of unlabeled test data without communication category labels. The pseudo-label generation module is used to calculate the neural network label, geometric label, and neighbor label of the unlabeled test data in the test data respectively, and generate pseudo-labels for the unlabeled test data based on the neural network label, geometric label, and neighbor label; The geometry generation module is used to construct geometry graphs of the source data and the test data after generating pseudo-labels by calling the geometry generation algorithm. The geometry matching module is used to perform spatial matching of the geometry of the source data and the data to be tested by combining shape preservation, rotation prevention, symmetry prevention and node distribution preservation algorithms, and to perform network communication detection on the data to be tested based on the geometry matching results.

9. An apparatus, comprising: The device includes a processor and a memory coupled to the processor, wherein, The memory stores program instructions for implementing the network communication detection method according to any one of claims 1-7; The processor is used to execute the program instructions stored in the memory to control network communication detection.

10. A storage medium, characterized by The device stores processor-executable program instructions for performing the network communication detection method according to any one of claims 1 to 7.

Images