An unbalanced protocol identification method based on residual U-Net network

Abstract

The present invention discloses an unbalanced protocol identification method based on a residual U-Net network, comprising: obtaining a network flow to be identified; preprocessing the network flow to be identified to obtain a one-dimensional matrix of a fixed length; inputting the one-dimensional matrix into a pre-trained unbalanced protocol identification model for feature extraction, and outputting a protocol identification result of the network flow to be identified. The present invention introduces an SE-Net network into the residual U-Net network to mine the importance of different channels of protocol data features, and selectively strengthens or suppresses some channels of protocol data features. At the same time, a new nonlinear activation function is introduced into the model. When activating the input, the new activation function can effectively reduce information loss, thereby improving the feature extraction capability of the model. In addition, the present invention proposes a weighted Dice loss function, which can effectively solve the problem of low accuracy of minority class protocol recognition due to imbalanced protocol data categories.

Description

Technical Field

[0001] The invention relates to an unbalanced protocol identification method based on a residual U-Net network, and belongs to the technical field of network protocol identification. Background Art

[0002] With the continuous development of network technology, new network protocols continue to emerge, and network traffic has increased dramatically, bringing severe challenges to network management and network security. Protocol identification aims to analyze the composition of network traffic and divide network traffic into different protocol categories. Protocol identification technology is an important part of optimizing network management, ensuring service quality, and preventing security risks.

[0003] In real network environments, network traffic often has the problem of unbalanced distribution of protocol categories. Some protocols have a large number of samples, which are called majority protocols. Some protocols have a small number of samples, which are called minority protocols. Due to their numerical advantage, majority protocols have always been the focus of research. However, minority protocols are likely to contain rich information. For example, malware uses a specific communication protocol to communicate with each other. The number of protocol samples is small and often hidden in normal communication traffic, making it difficult to find. Efficient and accurate identification of such protocols can timely detect abnormal communications in the network so that effective countermeasures can be taken. However, when training a protocol recognition model, the majority protocol often dominates the optimization direction of the protocol recognition model, resulting in a high recognition accuracy rate for the majority protocol and a low recognition accuracy rate for the minority protocol.

[0004] To address the problem of unbalanced protocol identification, existing methods can be mainly divided into four categories: data resampling methods, feature selection-based methods, ensemble algorithm-based methods, and cost-sensitive methods.

[0005] Currently, cost-sensitive methods are a hot topic in the field of imbalanced protocol identification. Cost-sensitive methods optimize the protocol identification model by assigning higher misclassification costs to minority protocols and lower misclassification costs to majority protocols, thereby minimizing the total misclassification cost and improving the accuracy of minority protocol identification.

[0006] From the existing research, the cost-sensitive unbalanced protocol identification method can more accurately identify minority protocols, avoid problems such as model overfitting, high time complexity and change of original data distribution, and the model generalization ability is better than other categories of methods. However, the existing cost-sensitive unbalanced protocol identification methods have problems such as simple model structure and weak feature extraction ability. Therefore, how to improve the feature extraction ability of the model and use the cost-sensitive loss function to effectively avoid the majority class protocol dominating the model optimization direction is the key to accurately identifying minority protocols. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and provide an unbalanced protocol identification method based on a residual U-Net network, thereby improving the overall feature extraction capability by improving the protocol identification model and promoting the model to strengthen the recognition of minority protocols by designing a reasonable loss function.

[0008] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0009] In a first aspect, the present invention provides an unbalanced protocol identification method based on a residual U-Net network, comprising:

[0010] Get the network flow to be identified;

[0011] Preprocess the network flow to be identified to obtain a one-dimensional matrix of fixed length;

[0012] Input the one-dimensional matrix into the pre-trained unbalanced protocol recognition model for feature extraction, and output the protocol recognition result of the network flow to be recognized;

[0013] The unbalanced protocol recognition model includes an encoder and a decoder connected to the encoder, the encoder and the decoder both include a plurality of residual U-Net network blocks with the same structure, the encoder also includes an embedding network block, and the decoder also includes a classification network block.

[0014] Furthermore, the preprocessing method includes network flow reassembly and segmentation and network protocol label marking.

[0015] Further, the encoder includes 4 sequentially connected residual U-Net network blocks, numbered Block1, Block2, Block3 and Block4, and the embedding network block is connected to Block1;

[0016] The decoder includes three residual U-Net network blocks, numbered Block5, Block6 and Block7. Except that the output end of Block7 is connected to the classification network block, the input end and output end of each residual U-Net network block of the decoder are connected to the splicing layer, and the splicing layer connected to the input end of Block5 is connected to the output end of Block4;

[0017] The output ends of Block1, Block2 and Block3 are connected to the splicing layers of the input ends of Block5, Block6 and Block7 respectively in a one-to-one correspondence.

[0018] Furthermore, the residual U-Net network block includes two processing channels, the first processing channel includes a BN layer, an h-swish activation function layer, a Conv1 layer, a BN layer, an h-swish layer and a Conv2 layer connected in sequence, and the second processing channel includes a Conv3 layer. The two processing channels are added and connected to the SE-Net network block.

[0019] Furthermore, the SE-Net network block includes a global average pooling layer, a deformation layer, two 1×1 convolutional layers and Activation function layer, the two 1×1 convolutional layers use the h-swish activation function.

[0020] Furthermore, the training method of the imbalanced protocol recognition model includes:

[0021] Acquire a training sample, wherein the training sample includes a network flow;

[0022] The training samples are input into the imbalanced protocol recognition model for iterative training until the loss function value tends to be stable, and the model training is completed.

[0023] Furthermore, the loss function is the W_Dice function, and the calculation formula is:

[0024]

[0025] Where K represents the number of protocol categories; s = 1, 2, ..., K represents the sth protocol; n s represents the number of network flows contained in the sth protocol category; ε represents a fixed constant; p i is the predicted protocol label corresponding to the i-th network flow; t i represents the real protocol label corresponding to the i-th network flow; w s Indicates the weight corresponding to the sth protocol category.

[0026] In a second aspect, the present invention provides an unbalanced protocol identification system based on a residual U-Net network, comprising:

[0027] Data acquisition module: used to obtain the network flow to be identified;

[0028] Preprocessing module: used to preprocess the network flow to be identified and obtain a one-dimensional matrix of fixed length;

[0029] Protocol identification module: used to input the one-dimensional matrix into the pre-trained unbalanced protocol identification model for feature extraction, and output the protocol identification result of the network flow to be identified.

[0030] In a third aspect, an unbalanced protocol identification device based on a residual U-Net network includes a processor and a storage medium;

[0031] The storage medium is used to store instructions;

[0032] The processor is used to operate according to the instructions to execute the steps of any of the methods described above.

[0033] In a fourth aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of any of the above methods.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] The present invention introduces the SE-Net network into the residual U-Net network to explore the importance of different channels of protocol data features, and selectively strengthens or suppresses some channels of protocol data features. At the same time, a new nonlinear activation function is introduced into the model. When activating the input, the new activation function can effectively reduce information loss, thereby improving the feature extraction ability of the model. In addition, the present invention proposes a weighted Dice loss function, which can effectively solve the problem of low accuracy of minority class protocol recognition caused by imbalanced protocol data categories. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a flow chart of the protocol identification method of the present invention.

[0037] Figure 2 is a network structure diagram of the unbalanced protocol identification model in the first embodiment;

[0038] Figure 3 is a network structure diagram of the residual U-Net network block in Example 1;

[0039] Figure 4 is a network structure diagram of the SE-Net network block in the first embodiment;

[0040] Figure 5 It is a flow chart of the processing method of the SE-Net network block in the first embodiment.

[0041] In the figure: Embedding represents embedding layer; BN represents batch normalization layer; h-swish represents activation function; Conv represents convolution layer; Addition represents the operation of adding corresponding elements; SE represents SE-Net network block designed by the present invention; ConvTrans represents transposed convolution layer; concatenate represents concatenation layer; Flatten represents expanding a two-dimensional matrix into a one-dimensional matrix; Dropout represents randomly making the output of a certain number of neurons 0; Dense represents fully connected layer; Global Pool represents global average pooling layer; Reshape represents deformation layer. DETAILED DESCRIPTION

[0042] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0043] The present invention provides an unbalanced protocol identification method based on a residual U-Net network, and the method specifically includes:

[0044] S1: Get the network flow to be identified;

[0045] S2: preprocess the network flow to be identified to obtain a one-dimensional matrix of fixed length;

[0046] S3: Input the one-dimensional matrix into the pre-trained unbalanced protocol recognition model for feature extraction, and output the protocol recognition result of the network flow to be recognized.

[0047] Among them, the unbalanced protocol recognition model includes an encoder and a decoder connected to the encoder, the encoder and the decoder both include multiple residual U-Net network blocks with the same structure, the encoder also includes an embedding network block, and the decoder also includes a classification network block.

[0048] Embodiment 1:

[0049] In this embodiment, the recognition method mainly includes four stages: data acquisition stage, model construction stage, model training stage and application stage. These four stages are described in detail below.

[0050] 1. Data Acquisition Phase

[0051] The data acquisition phase mainly involves data acquisition and data preprocessing, which includes three sub-steps: network flow acquisition, network flow reorganization and segmentation, and network protocol labeling. Data preprocessing is the basis of protocol identification and the prerequisite for the unbalanced protocol identification model to accurately identify protocols. First, multiple data packets are aggregated into network flows, and fixed-length data is intercepted from the network flows for protocol identification. Secondly, the network flows are labeled with protocol labels to indicate the protocol type to which each network flow belongs, so as to facilitate subsequent training and testing.

[0052] First, the network flow is acquired. In the field of network protocol identification, the analysis objects include data packets or network flows. Data packets are often the analysis objects of online protocol identification methods because the protocol can be quickly and accurately identified by analyzing data packets, which can meet the real-time requirements of online identification. Network flows are often the analysis objects of offline identification because network flows can aggregate multiple data packets together, integrate the information of multiple data packets, and more accurately identify the protocol. In this embodiment, an offline identification method is adopted, and network flows are selected as the analysis objects of protocol identification.

[0053] In the field of network protocol identification, a complete TCP connection or a UDP interaction represents a network flow. For a TCP connection, the TCP SYN and TCP FIN packets can be used to mark the start and end of the network flow, and the captured packets are sequentially organized into an ordered network flow based on the sequence number and identification bit of the TCP header. For network interactions of the UDP protocol, a time threshold is usually set. The sending time of the first captured UDP packet indicates the start time of the network flow. For subsequent captured UDP packets, the difference between their sending time and the start time of the network flow is calculated. If the difference is less than the time threshold, it indicates that the current network flow has not ended, and the data packet is spliced ​​to the end of the network flow; if the difference is greater than or equal to the time threshold, it indicates that the current network flow has ended, and the captured data packet belongs to the next network flow. Thus, the network flow to be identified is obtained.

[0054] Secondly, the network flow is reassembled and segmented. When multiple data packets are spliced ​​into an ordered network flow, only the data in the application layer of the data packet is retained for protocol identification. Data packets such as TCP SYN and TCP FIN are used to establish and end connections respectively, and do not contain information related to protocol identification. After the network flow is reassembled, these connection control packets need to be eliminated. Since the neural network has format requirements for input data, it is necessary to intercept data of a fixed length for protocol identification. For application layer protocols, the header format is often relatively fixed and is mainly used to transmit control information during the interaction process. The payload part is the data exchanged by the communicating parties, which is relatively random and has a relatively small effect on identifying the protocol. After multiple data packets are reassembled into a network flow, the header and payload parts of the data packet in each network flow will appear alternately, but because the protocol specifications of a large number of application layer protocols are not public, the boundary between the header and the payload cannot be accurately determined.

[0055] In order to retain the header information as much as possible, this embodiment starts from the first byte of the network flow, intercepts data of length L bytes, converts each byte into a value between 0 and 255, and obtains a one-dimensional matrix of length L for subsequent protocol identification to complete the reorganization and segmentation of the network flow.

[0056] Finally, network protocol labels are annotated. After the network flow is reorganized and segmented, in order to facilitate training and testing applications, the network flow needs to be annotated with protocol identification labels.

[0057] This embodiment uses one-hot encoding to label the network flow. The specific method is as follows: if the total number of protocol categories is C, then a one-dimensional vector of length C can be used to represent the protocol label. In the one-dimensional vector, except for one element set to 1, all other elements are 0. If the nth element in the vector is 1, it means that the corresponding network flow belongs to the nth protocol. For example, if the data set contains 9 types of protocols, then [1,0,0,0,0,0,0,0,0]T Represents the first protocol, [0,1,0,0,0,0,0,0,0] T represents the second protocol, and the other protocols are analogous. Finally, C categories are output, and the length of each category is a one-dimensional matrix of L.

[0058] 2. Model Building Phase

[0059] During the model building stage, when the distribution of protocol categories is unbalanced, the majority class protocols will dominate the optimization direction of the protocol identification model. When the overall protocol identification accuracy is high, the identification accuracy of the minority class protocols is likely to be relatively low. Using feature fusion to improve the feature extraction ability of the classification model, and designing a loss function based on the characteristics of unbalanced protocol categories, and essentially changing the optimization direction in which the majority class protocols always dominate the model, is the key to accurately identifying minority class protocols. The feature fusion method used in this embodiment can effectively improve the feature extraction ability of the classification model, and can improve the identification accuracy of both the majority class protocols and the minority class protocols. At the same time, designing a loss function based on the characteristics of unbalanced protocol categories and changing the problem that the majority class protocols always dominate the optimization direction of the model can ensure that the model can more accurately identify minority class protocols.

[0060] like Figure 2 As shown, the unbalanced protocol recognition model in this embodiment includes an encoder and a decoder connected to the encoder, and the encoder and the decoder are mainly composed of residual U-Net network blocks. Among them, the encoder includes an embedding network block and 4 residual U-Net network blocks connected in sequence; the decoder includes 3 residual U-Net network blocks and a classification network block.

[0061] The embedding network block of the encoder includes the Embedding layer (short for embedding layer), Conv0 layer (short for convolutional layer), BN layer (short for batch normalization layer), and h-swish activation function layer connected in sequence, where the Conv0 layer consists of 16 convolution kernels of size 5 and stride 4.

[0062] The one-dimensional matrix of length L outputted from stage 1 is the input of the model, i.e., the input of the embedding layer. Since each element in the one-dimensional matrix of length L represents a byte in the network flow, each element is mapped to a random one-dimensional matrix of length M, so L elements correspond to L one-dimensional matrices, and L one-dimensional matrices are regarded as L row matrices of a two-dimensional matrix. Therefore, the Embedding layer can concatenate the input one-dimensional matrix of length L in the order of elements and obtain an L×M two-dimensional matrix. The L×M two-dimensional matrix is ​​input to the Conv0 layer, and the output of the Conv0 layer is processed by the BN layer and the h-swish activation function layer.

[0063] The network structure of the residual U-Net network block is as follows Figure 3 As shown, residual connection is used, including two processing channels. The first processing channel includes a BN layer, an h-swish activation function layer, a Conv1 layer, a BN layer, an h-swish layer, and a Conv2 layer connected in sequence. The second processing channel includes a Conv3 layer. The processing results of the two processing channels are added and connected to the SE-Net network block. Downsampling through the Conv3 layer can reduce the input dimension, thereby reducing the scale of model parameters and improving model training efficiency. The residual connection is used to splice the outputs of the two channels according to the channel dimension, which can effectively solve the problem of information loss when the Conv3 layer is downsampled, improve the classifiability of the model, and avoid problems such as gradient disappearance and model performance degradation. The feature extraction capability is effectively improved.

[0064] The calculation formula of the h-swish activation function in the residual U-Net network block is:

[0065]

[0066] In the formula, x is the input data, and ReLU6 represents the activation function. The h-swish activation function is a nonlinear activation function that can reduce the computational complexity in the nonlinear activation process, improve the efficiency of feature extraction, and effectively alleviate the problem of gradually increasing differences in parameter values ​​of each layer during model optimization, thereby improving the classification accuracy of the model.

[0067] The network structure of the SE-Net network block is as follows Figure 4 and Figure 5 As shown in Figure 2, residual connections are also used, including two processing channels. The first channel includes a global average pooling layer, a deformation layer, two 1×1 convolutional layers, and Activation function layer. The deformation layer adjusts the shape of the input so that it can meet the input requirements of the subsequent convolutional layer. The two 1×1 convolutional layers are activated using the h-swish activation function.

[0068] exist Figure 5 In the processing flow chart of the SE-Net network block in , the input is a two-dimensional matrix after the two processing channels of the U-Net network block are spliced ​​according to the channel dimension, and then the first 1xC matrix is ​​obtained through the global average pooling layer and the deformation layer; then two 1x1 convolutional layers are used in sequence to analyze the importance of each channel based on the obtained 1xC matrix, and the The activation function performs nonlinear activation. The two 1x1 convolutional layers are set and C 1x1 convolution kernels, and the corresponding output and the second 1xC matrix. Finally, the obtained 1xC matrix is ​​used to strengthen each channel of the spliced ​​two-dimensional matrix. The method is to obtain each channel of the spliced ​​two-dimensional matrix in turn, and obtain the weight corresponding to the channel from the second 1xC matrix, and multiply the weight with all elements of the channel to obtain the processed two-dimensional matrix. Each channel of the processed two-dimensional matrix is ​​effectively strengthened, and the influence of important channels on subsequent protocol recognition tasks is effectively improved.

[0069] This embodiment integrates the SE-Net network block into the residual U-Net network block, introduces the SE-Net network block to improve the residual U-Net network block, mines the correlation between different channels of protocol data features, and then assigns different weights to different channels. According to the weights, some channels of protocol data features are selectively strengthened or suppressed, and the influence of key channels on subsequent classification tasks is enhanced. The SE-Net network block will strengthen the characteristics of all protocols, which is helpful to improve the recognition accuracy of majority and minority protocols at the same time.

[0070] like Figure 2 As shown in the figure, the four residual U-Net network blocks of the encoder are numbered Block1, Block2, Block3 and Block4, and the input of Block1 is connected to the output of the embedding network block. Block1 to Block4 have the same settings except for the number of convolution kernels in the convolution layer. The number of convolution kernels in the convolution layer of Block1 to Block4 is set to 16, 32, 64 and 128 respectively.

[0071] Taking Block1 as an example, the process of extracting protocol data features by the encoder is introduced. In the first processing channel, the input of Block1 is first pre-activated using the BN layer and the h-swish activation function, and then input to the Conv1_1 layer. The Conv1_1 layer includes 16 convolution kernels of size 5 and stride 2. Then, the output of the convolution layer Conv1_1 is pre-activated using the BN layer and the h-swish activation function layer, and then input to the convolution layer Conv1_2. The convolution layer Conv1_2 includes 16 convolution kernels of size 5 and stride 1. Finally, for the input of Block1, the convolution layer Conv1_3 is used in the second processing channel to perform dimension upscaling and downsampling to ensure that the shapes of the channels of the outputs of the convolution layers Conv1_3 and Conv1_2 are the same, so that channel splicing can be performed. The convolution layer Conv1_3 includes 16 convolution kernels with a size of 1 and a stride of 2. The output of the convolution layer Conv1_3 and the corresponding elements of the output of Conv1_2 are added and input into the SE-Net network block to obtain the output of Block1. Since the convolution layer Conv1_3 includes 16 convolution kernels, that is, the number of channels contained in the input of the SE-Net network block is 16, the two 1x1 convolution layers of the SE-Net network block are set to contain 4 and 16 convolution kernels with a size of 1 and a stride of 1, respectively.

[0072] like Figure 2 As shown, the three residual U-Net network blocks of the decoder are numbered Block5, Block6 and Block7 respectively.

[0073] After being processed by the embedded network block and Block1~4, the redundant features in the protocol data are eliminated, and only the most discriminative protocol features are retained. At the same time, the scale of network parameters is effectively reduced through downsampling. On this basis, Block5~7 are used in sequence to restore the output of Block4 to the input of the protocol recognition model. Even though the output of Block7 is very similar to the input of Block1, compared with the input of Block1, the output of Block7 contains more fine-grained protocol data features, which can improve the classification performance of the model. Among them, the output of Block7 is the output result of the SE-Net network block in Block7, and the input of Block1 is the output of the h-swish activation function in the embedded network block before Block1. Since Block5~7 have the same structure, they are all upsampled by the ConvTrans layer (short for transposed convolution layer), and then the output of a module before the module is fused by splicing according to the channel dimension. The spliced ​​result is input to the improved residual U-Net network block basic module. Blocks 5 to 7 have the same settings except for the number of convolution kernels in the convolution layer. Block 5, Block 6, and Block 7 have 64, 32, and 16 convolution kernels, respectively.

[0074] The following uses Block 5 as an example to introduce the process of extracting protocol data features by the module. Block 5 first uses the ConvTrans layer to upsample the output of Block 4. The ConvTrans layer includes 64 convolution kernels with a size of 5 and a stride of 2. The output of the ConvTrans layer has the same shape as the output of Block 3 in each channel, except for the number of channels. The output of the ConvTrans layer and the output of Block 3 are concatenated according to the channel dimension (concatenate in the figure indicates the operation of concatenating according to the channel dimension). Then, the Conv5_1 layer and the Conv5_2 layer are used to extract the features of the concatenated results in turn. Before the convolution operation of the Conv5_1 layer and the Conv5_2 layer, the BN layer and the h-swish activation function layer are used for pre-activation. The Conv5_1 layer and the Conv5_2 layer both include 64 convolution kernels with a size of 5 and a stride of 1. Finally, the Conv5_3 layer is used to mine the features of the concatenated results. The Conv5_3 layer includes 64 convolution kernels with a size of 1 and a stride of 1. The output of Conv5_3 layer and the corresponding elements of the output of Conv5_2 layer are added, and the result is input into the SE-Net network block to obtain the output of Block 5. Since the convolution layer Conv5_3 in Block 5 contains 64 convolution kernels and the input of the SE-Net network block contains 64 channels, the two convolution layers in the SE-Net network block of Block 5 are set to contain 16 and 64 convolution kernels of size 1 and stride 1 respectively.

[0075] like Figure 2 As shown, the classification network block includes a Flatten layer, a Dropout layer, a Dense layer, and an h-swish activation function layer connected in sequence, and the h-swish activation function layer is also connected to the Softmax classifier. The unbalanced protocol recognition model will eventually output a one-dimensional matrix, the length of which is the total number of target protocol categories C, and each component represents the probability that the input of the unbalanced protocol recognition model belongs to the corresponding protocol category. The designed model uses the Flatten layer to expand the output of Block7 into a one-dimensional matrix, and then inputs the obtained one-dimensional matrix into the Dropout layer and the Dense layer, and uses the h_swish activation function layer to activate the output of the Dense layer. Among them, the Dropout layer is used to prevent the model from overfitting, and the Dense layer is used to extract the features of the protocol data. Finally, the activated data is input into the Softmax classifier, and the classifier outputs the predicted protocol type. Among them, the Dense layer is set with 64 neurons, and the number of neurons of the Softmax classifier is the same as the number of protocol categories.

[0076] This embodiment uses the residual U-Net network block as the basis for protocol identification. In the protocol identification model, the SE-Net network block can enhance the features of minority protocols and perform feature fusion by splicing by channel, ensuring that even if the number of samples of minority protocols is small, rich protocol data features can still be extracted. At the same time, the word embedding technology of the embedding layer, the residual connection of the U-Net network block, and the new activation function can ensure that the model can mine richer features of minority protocols. These key designs can significantly improve the recognition accuracy of minority protocols.

[0077] 3. Model training stage

[0078] After the imbalanced protocol identification model is built, the model needs to be trained. The training method is:

[0079] Acquire training samples, which include network flows; preprocess the training samples according to the data acquisition stage and then input them into the unbalanced protocol recognition model for forward propagation and back propagation training until the loss function value tends to be stable, thus completing the model training.

[0080] Among them, forward propagation is to input the protocol data into the protocol recognition model. The model automatically mines the representative features of the protocol data and outputs the target protocol type based on the features. Backward propagation is to use the loss function to calculate the error between the predicted protocol type and the true protocol type. The error is reversely processed from the Softmax classifier according to the model logic processing order through back propagation and passed to the embedded network block. Each network layer in the model updates the network parameters according to the error. Forward propagation and back propagation are performed alternately, the error value gradually decreases, and the predicted protocol type gradually approaches the true protocol type. When the error value tends to be stable, the optimization process of the protocol recognition model will stop, and the maturely trained protocol recognition model will be saved.

[0081] The loss function used in this embodiment is the W_Dice function, that is, the weighted Dice function, which assigns larger and smaller weights to the minority class agreement and the majority class agreement respectively, and weights the predicted labels of each type of sample. The calculation formula of the W_Dice function is:

[0082]

[0083] Where K represents the number of protocol categories; s = 1, 2, ..., K represents the sth protocol; n s represents the number of network flows contained in the sth protocol category; ε represents a fixed constant; p i is the predicted protocol label corresponding to the i-th network flow; t i represents the real protocol label corresponding to the i-th network flow; w s Indicates the weight corresponding to the sth protocol category.

[0084] Among them, the weight corresponding to a certain type of protocol represents the cost of misclassifying the protocol category. The total number of network flows is divided by the number of network flows contained in this type of protocol, and the result is used as the weight of this type of protocol, that is, w in the formula s For example, assuming that the total number of network flows is 10,000, A and B are two network protocols, and the number of network flows contained in them is 500 and 5,000 respectively, then the weights w of categories A and B are s They are 20 and 2 respectively. The weight corresponding to each type of protocol involves the number of network flows contained in this type of protocol and the total number of captured network flows, which can fully reflect the distribution of each protocol category within the data set. The setting of the weight is scientific and reasonable.

[0085] In the loss function formula, since the misclassification cost of the minority class protocol is greater than the misclassification cost of the majority class protocol, although the number of samples misclassified by the minority class protocol is less than the number of samples misclassified by the majority class protocol, after weighted processing, the model will focus on the minority class protocol and actively improve the recognition accuracy of the minority class protocol. Compared with the traditional Dice loss function, the weighted Dice loss function further reduces the correlation between the model classification error and the number of samples misclassified by each type of protocol by assigning different weights to each type of protocol, and can more effectively solve the problem of imbalanced class distribution.

[0086] 4. Application Phase

[0087] After the unbalanced protocol recognition model is trained in stage three, actual network protocol prediction can be performed. The captured network flow is preprocessed according to the preprocessing method of the present invention, and then input into the trained unbalanced protocol recognition model. The protocol recognition model uses the embedded network block to mine the association between the bytes of the protocol data, and then repeatedly mines the features of the protocol data through the residual U-Net network basic module. Finally, the Softmax classifier is used to output the predicted protocol type based on the extracted feature information.

[0088] Embodiment 2:

[0089] An unbalanced protocol identification system based on a residual U-Net network, characterized by comprising:

[0090] Data acquisition module: used to obtain the network flow to be identified;

[0091] Preprocessing module: used to preprocess the network flow to be identified and obtain a one-dimensional matrix of fixed length;

[0092] Protocol identification module: used to input the one-dimensional matrix into the pre-trained unbalanced protocol identification model for feature extraction, and output the protocol identification result of the network flow to be identified.

[0093] Embodiment three:

[0094] The embodiment of the present invention also provides an unbalanced protocol identification device based on a residual U-Net network, including a processor and a storage medium;

[0095] The storage medium is used to store instructions;

[0096] The processor is used to operate according to the instructions to perform the steps of the following method:

[0097] Get the network flow to be identified;

[0098] Preprocess the network flow to be identified to obtain a one-dimensional matrix of fixed length;

[0099] The one-dimensional matrix is ​​input into the pre-trained unbalanced protocol recognition model for feature extraction, and the protocol recognition result of the network flow to be recognized is output.

[0100] Embodiment 4:

[0101] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the following method are implemented:

[0102] Get the network flow to be identified;

[0103] Preprocess the network flow to be identified to obtain a one-dimensional matrix of fixed length;

[0104] The one-dimensional matrix is ​​input into the pre-trained unbalanced protocol recognition model for feature extraction, and the protocol recognition result of the network flow to be recognized is output.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0106] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identifying unbalanced protocols based on residual U-Net network, characterized in that: include: Get the network flow to be identified; Preprocess the network flow to be identified to obtain a one-dimensional matrix of fixed length; Input the one-dimensional matrix into the pre-trained unbalanced protocol recognition model for feature extraction, and output the protocol recognition result of the network flow to be recognized; The unbalanced protocol recognition model includes an encoder and a decoder connected to the encoder, the encoder and the decoder both include a plurality of residual U-Net network blocks with the same structure, the encoder also includes an embedding network block, and the decoder also includes a classification network block; The residual U-Net network block includes two processing channels, the first processing channel includes a BN layer, an h-swish activation function layer, a Conv1 layer, a BN layer, an h-swish layer, and a Conv2 layer connected in sequence, and the second processing channel includes a Conv3 layer. The two processing channels are added and connected to the SE-Net network block; The SE-Net network block includes a global average pooling layer, a deformation layer, two 1×1 convolutional layers, and Activation function layer, two 1×1 convolutional layers use h-swish activation function; The training method of the imbalanced protocol identification model includes: Acquire a training sample, wherein the training sample includes a network flow; Input the training samples into the imbalanced protocol recognition model for iterative training until the loss function value tends to be stable, completing the model training; The loss function is the W_Dice function, and the calculation formula is: Where K represents the number of protocol categories; s = 1, 2, ..., K represents the sth protocol; n s represents the number of network flows contained in the sth protocol category; ε represents a fixed constant; p i is the predicted protocol label corresponding to the i-th network flow; t i represents the real protocol label corresponding to the i-th network flow; w s Indicates the weight corresponding to the sth protocol category.

2. The unbalanced protocol identification method based on residual U-Net network according to claim 1 is characterized in that: The preprocessing method includes network flow reassembly and segmentation and network protocol label marking.

3. The unbalanced protocol identification method based on residual U-Net network according to claim 1 is characterized in that: The encoder includes four sequentially connected residual U-Net network blocks, numbered Block1, Block2, Block3 and Block4, and the embedding network block is connected to Block1; The decoder includes three residual U-Net network blocks, numbered Block5, Block6 and Block7. Except that the output end of Block7 is connected to the classification network block, the input end and output end of each residual U-Net network block of the decoder are connected to the splicing layer, and the splicing layer connected to the input end of Block5 is connected to the output end of Block4; The output ends of Block1, Block2 and Block3 are connected to the splicing layers of the input ends of Block5, Block6 and Block7 respectively in a one-to-one correspondence.

4. An unbalanced protocol identification system based on residual U-Net network, characterized in that: include: Data acquisition module: used to obtain the network flow to be identified; Preprocessing module: used to preprocess the network flow to be identified and obtain a one-dimensional matrix of fixed length; Protocol identification module: used to input the one-dimensional matrix into the pre-trained unbalanced protocol identification model for feature extraction, and output the protocol identification result of the network flow to be identified; The unbalanced protocol recognition model includes an encoder and a decoder connected to the encoder, the encoder and the decoder both include a plurality of residual U-Net network blocks with the same structure, the encoder also includes an embedding network block, and the decoder also includes a classification network block; The residual U-Net network block includes two processing channels, the first processing channel includes a BN layer, an h-swish activation function layer, a Conv1 layer, a BN layer, an h-swish layer, and a Conv2 layer connected in sequence, and the second processing channel includes a Conv3 layer. The two processing channels are added and connected to the SE-Net network block; The SE-Net network block includes a global average pooling layer, a deformation layer, two 1×1 convolutional layers, and Activation function layer, two 1×1 convolutional layers use h-swish activation function; The training method of the imbalanced protocol identification model includes: Acquire a training sample, wherein the training sample includes a network flow; Input the training samples into the imbalanced protocol recognition model for iterative training until the loss function value tends to be stable, completing the model training; The loss function is the W_Dice function, and the calculation formula is: Where K represents the number of protocol categories; s = 1, 2, ..., K represents the sth protocol; n s represents the number of network flows contained in the sth protocol category; ε represents a fixed constant; p i is the predicted protocol label corresponding to the i-th network flow; t i represents the real protocol label corresponding to the i-th network flow; w s Indicates the weight corresponding to the sth protocol category.

5. An unbalanced protocol identification device based on residual U-Net network, characterized in that: including processor and storage medium; The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the method according to any one of claims 1 to 3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images