Botnet detection method based on attention mechanism

Abstract

The application discloses a botnet detection method based on an attention mechanism, and relates to the technical field of network security, and steps are as follows: S1, a data set is acquired, and the data set is preprocessed to obtain a preprocessed data set; S2, a botnet detection model based on the attention mechanism is constructed, and the preprocessed data set is used for training; and S3, network data flow is captured, and whether the captured network data flow is from a botnet is determined by using the trained botnet detection model; according to the characteristics that the number of new botnet flow samples is small, the adaptive comprehensive oversampling algorithm and the principal component analysis method are used for preprocessing the data set, and the detection accuracy of the detection model on the new botnet is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and more particularly to a botnet detection method based on an attention mechanism. BACKGROUND

[0002] According to the 50th Statistical Report on the Development of China Internet released by China Internet Network Information Center (CNNIC), as of June 2022, the number of netizens in China reached 1.051 billion, an increase of 19.19 million compared with December 2021, and the Internet penetration rate reached 74.4%. As can be seen from the report, the Internet has become an indispensable part of the lives of the Chinese people, but the security threats brought about by Internet technology cannot be underestimated.

[0003] Botnet is a common attack method used by criminals to make illegal profits through the network. Botnet develops rapidly, has a wide range of impact, and has great destructive power. Compared with traditional viruses and worms, it is a greater threat and has become one of the biggest threats in the security industry. Botnet mainly spreads bot programs, and a large number of hosts are infected. It can control the hosts infected with bot programs through command and control channels to perform malicious activities, including click fraud, distributed denial of service (DDoS), spam, confidential information theft, and virtual currency mining, which poses a great threat to the information security of countries, organizations, and individuals.

[0004] The traffic data of botnet is often similar and shows differences from normal traffic. In view of this characteristic, the detection of botnet currently mainly applies machine learning algorithms, such as random forest algorithm, support vector machine (SVM), k-means, etc. Such methods use supervised learning methods to establish models based on manually labeled network traffic features to detect bot traffic, but the manual labeling feature-based method is labor-intensive and requires a large number of experts with sufficient domain knowledge to ensure feature accuracy. In recent years, researchers have also begun to use deep learning algorithms to detect botnet traffic and have achieved some good results, such as convolutional neural network (CNN), recurrent neural network (RNN), etc., which have solved the pain points of manually labeled features. However, the number of samples of new botnet traffic is often small, and existing deep learning-based detection models are difficult to accurately detect new botnet traffic, resulting in low detection accuracy of new botnet traffic by the detection model.

[0005] The prior art discloses a botnet traffic classification detection method, comprising the following steps: acquiring a botnet traffic dataset; converting the botnet traffic dataset into a single-channel two-dimensional gray image matrix; inputting the single-channel two-dimensional gray image matrix into a preset separable convolutional neural network model for detection, determining whether the botnet traffic dataset corresponding to the single-channel two-dimensional gray image matrix belongs to malicious traffic, and if the botnet traffic dataset belongs to malicious traffic, determining a malicious category; wherein the preset separable convolutional neural network model is obtained based on a machine learning algorithm by taking a single-channel two-dimensional gray image matrix sample as input data and a detection result corresponding to the single-channel two-dimensional gray image matrix sample as output data; the detection result comprises: not belonging to malicious traffic, or belonging to malicious traffic and a malicious category corresponding to the malicious traffic; however, the detection model has low detection accuracy for new botnets due to the small number of new botnet traffic samples. SUMMARY

[0006] The application aims to solve the problem in the prior art that the detection model has low detection accuracy for new botnets due to the small number of new botnet traffic samples, and proposes a botnet detection method based on an attention mechanism, which trains a botnet detection model based on an attention mechanism by using a dataset preprocessed by an adaptive comprehensive oversampling algorithm and a principal component analysis method, and improves the detection accuracy of the model.

[0007] To solve the above technical problems, the technical scheme adopted by the application is as follows:

[0008] A botnet detection method based on an attention mechanism, comprising the following steps:

[0009] S1: acquiring a dataset, preprocessing the dataset to obtain a preprocessed dataset; the preprocessing method is as follows: dividing the traffic data according to a five-tuple to obtain a single data stream set; extracting traffic statistical features in the single data stream set, and performing one-hot encoding on non-numerical traffic statistical features; using an adaptive comprehensive oversampling algorithm to realize data enhancement, and using a principal component analysis method to realize data dimension reduction;

[0010] S2: constructing a botnet detection model based on an attention mechanism, and training the model according to the preprocessed dataset;

[0011] S3: capturing network data streams, and using the trained botnet detection model to determine whether the captured network data streams come from a botnet.

[0012] The working principle of the application is as follows:

[0013] The traffic data of the data set is segmented by a five-tuple, the data set is preprocessed by an adaptive comprehensive oversampling algorithm and a principal component analysis method, an attention mechanism-based botnet detection model is constructed, the network detection model is trained by the preprocessed data set, and whether the captured network data flow is from a botnet is determined by using the trained botnet detection model.

[0014] Preferably, the method for training the botnet detection model is as follows:

[0015] The processed data set is divided into a training set and a test set, wherein the training set includes N botnet traffic, the test set includes M botnet traffic, M is greater than N, and N and M are positive integers;

[0016] Randomly initialize the parameters in the network, and one round of iterative training of the botnet detection model consists of one forward propagation and one backward propagation;

[0017] The forward propagation process is as follows: the training set is transmitted layer by layer through the entire botnet detection model to obtain corresponding feature values and obtain a prediction structure; the actual result and the prediction result are taken as inputs of a cross-entropy loss function to calculate the error between the actual result and the prediction result and obtain a loss value;

[0018] The backward propagation process is as follows: based on the obtained loss value, the gradients of the parameters of the botnet detection model are calculated, and the parameters of the botnet detection model are updated according to the corresponding gradients;

[0019] After multiple rounds of iterative training, the botnet detection model to be tested is obtained, the test set is input into the botnet detection model to be tested for testing, and the accuracy of the botnet detection model is detected; if the accuracy is less than a threshold value, training is performed, and if the accuracy is greater than the threshold value, the next step is performed;

[0020] The cross-entropy loss function formula is as follows:

[0021]

[0022] Wherein, Loss represents the cross-entropy loss function, N represents the number of samples, y i represents the real label of the sample, represents the predicted label of the sample.

[0023] Preferably, the five-tuple includes a source IP, a source port, a destination IP, a destination port, and a communication protocol.

[0024] Preferably, the adaptive comprehensive oversampling algorithm has the following steps:

[0025] S201: Calculate the ratio d of the minority class samples to the majority class samples;

[0026]

[0027] wherein m s represents the number of minority class samples, m l represents the number of majority class samples;

[0028] S202: Calculate the total number G of minority class samples to be generated;

[0029] G = (m l -m s ) x β

[0030] wherein β is the ratio of minority class samples to majority class samples; β = 1 indicates that the data set obtained after the adaptive comprehensive oversampling algorithm is executed is completely balanced in terms of minority class samples and majority class samples;

[0031] S203: Calculate k neighbors for the minority class samples using the Euclidean distance, Δ i is the number of majority class samples in the k neighbors, calculate the proportion r i of majority class samples in each specific neighborhood;

[0032]

[0033] S204: Normalize the r i values so that the sum of all r i values is equal to 1;

[0034]

[0035]

[0036] S205: Calculate the number g i of synthetic samples for each minority class sample;

[0037]

[0038] Since r i has a higher value in the neighborhood dominated by majority class samples, more synthetic minority class samples will be generated for these neighborhoods;

[0039] S206: Generate synthetic minority class samples s i ;

[0040] s i = x i + (x zi -x i ) x λ

[0041] wherein λ is a random number and satisfies λ ∈ [0, 1]; xi x represents the current minority class sample zi x represents a random minority class sample within the k neighborhood.

[0042] Further, the steps of the principal component analysis method are as follows:

[0043] S211: using the min-max method to normalize the feature vector, so that all data is distributed in [0, 1], the calculation formula is:

[0044]

[0045] In the formula, X is the original feature data, X max is the maximum value before feature standardization, X min is the minimum value before feature standardization;

[0046] S212: calculate the covariance matrix of the features in the data set;

[0047] S213: run the characteristic equation of the covariance matrix, extract all eigenvalues, arrange the feature vectors in descending order according to the size of the corresponding eigenvalues, and mark them as λ1> λ2>...> λ n , according to the eigenvalues, the eigenvectors are solved, marked as w1, w2,..., w n , wherein the characteristic equation is as follows:

[0048] R-λE=0

[0049] S214: extract k principal components corresponding to the eigenvalues with cumulative contribution rate between 80%-95%, the cumulative contribution rate calculation formula is:

[0050]

[0051] Finally, the dimension-reduced feature matrix W=(w1, w2,..., w k ) is obtained.

[0052] Preferably, the botnet detection model comprises a convolutional neural network, an attention mechanism module, a bidirectional long short-term memory network, a fully connected layer, and an output layer connected in sequence.

[0053] The convolutional neural network is used to extract feature information of the input data as the input of the attention mechanism module.

[0054] The attention mechanism module is used to reassign the weights of the channels according to the input feature information.

[0055] The bidirectional long short-term memory network is used to learn the relationship between features in network traffic.

[0056] The full connection layer is used for mapping feature information into a larger space, increasing the representation ability of the botnet detection model.

[0057] The output layer is used for outputting the result of detection classification.

[0058] Further, the convolutional neural network comprises a first convolutional layer C1, a first pooling layer S1 and a second convolutional layer C2 connected in sequence.

[0059] The first convolutional layer C1 is composed of two 3x3 convolutional layers in series; the first pooling layer S1 is a maximum pooling layer or an average pooling layer; and the second convolutional layer C2 uses a 1x1 convolutional kernel.

[0060] Further, the attention mechanism module uses a convolutional block attention module.

[0061] The convolutional block attention module is used for two-dimensional data processing and is composed of a squeezing stage and an excitation stage.

[0062] In the squeezing stage, the traffic data feature map F is respectively input into a global average pooling layer and a maximum pooling layer to extract feature information of the feature map from two different dimensions, and is converted from a (c, w) dimensional form to a (c, 1) dimensional form to obtain two compressed data, so as to obtain global information of each channel.

[0063] In the excitation stage, the compressed data is adaptively recalibrated by a multilayer perceptron to assign weights to each channel of the feature map, and two (c, 1) dimensional feature maps are obtained, which are then added and then input into a sigmoid activation function to finally obtain a weight vector M. C C The calculation formula is as follows:

[0064] M C =σ(W(AvgPool(F))+W(MaxPool(F)))

[0065] In the formula, σ represents a sigmoid activation function, W represents a multilayer perceptron parameter, AvgPool represents an average pooling layer, MaxPool represents a maximum pooling layer, and F represents input traffic data features.

[0066] Further, the bidirectional long short-term memory network comprises a first LSTM layer and a second LSTM layer.

[0067] The first LSTM layer obtains input in a forward manner, and the second LSTM layer obtains input in a reverse manner.

[0068] The update of the first LSTM layer and the second LSTM layer at one time step is as follows: ​

[0069] i t =σ(W xi x t +W hi h t-1 +b i )

[0070] f t =σ(W xf x t +W hf h t-1 +b f )

[0071] o t =σ(W xo x t +W ho h t-1 +b o )

[0072]

[0073]

[0074] h t =o t tan h(c t )

[0075] Among them, i t f t and o t These represent the input gate, forget gate, and output gate, respectively; σ and tanh represent two different activation functions; c t c represents the state of the current cell. t-1 This represents the state of the previous unit. Represents candidate memory units; h t h represents the hidden state of the current cell. t-1 Represents the hidden state of the previous unit;

[0076] The update process of the bidirectional long short-term memory network at one time step is as follows:

[0077]

[0078]

[0079]

[0080] Among them, h t h represents the hidden state of the current cell. t-1 Represents the hidden state of the previous unit. This represents the positive hidden state of the current cell. The reverse hidden state representing the current unit is used for network traffic. Bidirectional long short-term memory networks utilize the temporal characteristics of existence to improve the training of botnet detection models.

[0081] Furthermore, the fully connected layer includes a first fully connected layer FC1 and a second fully connected layer FC2; the first fully connected layer FC1 consists of 32 neurons and outputs a 32-dimensional vector; the second fully connected layer FC2 consists of 16 neurons and outputs a 16-dimensional vector; the activation function used by the first fully connected layer FC1 and the second fully connected layer FC2 is the ReLU function.

[0082] The output layer uses the Sigmoid function as its activation function, and outputs the final zombie network detection and classification results. The Sigmoid function is calculated as follows:

[0083]

[0084] In the formula, x represents the sum of weights of the previous fully connected layer, and v represents the probability value of the final botnet detection and classification result.

[0085] Compared with the prior art, the beneficial effects of the present invention are:

[0086] 1. Using an adaptive comprehensive oversampling method to augment minority class samples helps prevent model overfitting.

[0087] 2. Principal component analysis is used as a data dimensionality reduction method, which reduces the loss of information to a certain extent while reducing dimensionality.

[0088] 3. Attention-based botnet detection models focus on more important feature information and utilize the temporal nature of traffic data for classification and detection, further improving the detection accuracy. Attached Figure Description

[0089] Figure 1 This is a flowchart illustrating the steps of an attention-based botnet detection method.

[0090] Figure 2 This is a network architecture diagram of the botnet detection model. Detailed Implementation

[0091] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0092] Example 1

[0093] In this embodiment, as Figure 1 As shown, a botnet detection method based on an attention mechanism includes the following steps:

[0094] S1: obtain a data set, pre-process the data set to obtain a pre-processed data set; the pre-processing method is as follows: the flow data of the data set is segmented according to a five-tuple to obtain a single data stream set; the flow statistical features in the single data stream set are extracted, and the non-numerical flow statistical features are one-hot encoded; data enhancement is realized by using an adaptive comprehensive oversampling algorithm, and data dimension reduction is realized by using a principal component analysis method;

[0095] S2: a botnet detection model based on an attention mechanism is constructed, and the pre-processed data set is used for training;

[0096] S3: network data streams are captured, and the trained botnet detection model is used to determine whether the captured network data streams come from a botnet.

[0097] The working principle of the application is as follows:

[0098] The flow data of the data set is segmented by a five-tuple, the data set is pre-processed by an adaptive comprehensive oversampling algorithm and a principal component analysis method, a botnet detection model based on an attention mechanism is constructed, the network detection model is trained by the pre-processed data set, and the trained botnet detection model is used to determine whether the captured network data streams come from a botnet.

[0099] In the embodiment, the five-tuple includes a source IP, a source port, a destination IP, a destination port, and a communication protocol. The data set uses an ISCX botnet data set; the ISCX botnet data set was created in 2014, and it is a botnet data set created by the Network Security Research Lab of the University of New Brunswick in Canada. The data set combines the subsets of ISOT, ISCX 2012 IDS, and Botnet traffic generated by the Malware Capture Facility Project through a coverage method; a data stream is defined as a collection of data packets with the same five-tuple and arranged in chronological order; a data packet is represented as (q, l, t); wherein q represents the five-tuple of the data packet, l represents the length of the data packet, and t represents the start time of the data packet;

[0100] The single data stream is defined as:

[0101] p=(q,l,t)

[0102] In the formula, p represents a single data stream.

[0103] The statistical features include flow duration, reconnection times, and other features reflecting the communication mode of the flow, from which a 112-dimensional feature vector is extracted; the non-numerical features include protocol and other features.

[0104] In the embodiment, the method for constructing the botnet detection model for training is as follows:

[0105] The processed data set is divided into a training set and a test set, wherein the training set includes N botnet traffics; the test set includes M botnet traffics; M is greater than N, and N and M are positive integers;

[0106] The parameters in the network are randomly initialized, and one round of iterative training of the botnet detection model is composed of one forward propagation and one backward propagation;

[0107] The forward propagation process is as follows: the training set is transmitted layer by layer through the entire botnet detection model to obtain corresponding feature values and obtain a prediction structure; the actual result and the prediction result are taken as inputs of a cross-entropy loss function to calculate the error between the actual result and the prediction result and obtain a loss value;

[0108] The backward propagation process is as follows: the gradients of the parameters of the botnet detection model are calculated based on the obtained loss value, and the parameters of the botnet detection model are updated and optimized according to the corresponding gradients;

[0109] After multiple rounds of iterative training, the botnet detection model to be tested is obtained, the test set is input into the botnet detection model to be tested for testing, the accuracy of the botnet detection model is detected; if the accuracy is less than a threshold value, training is performed, and if the accuracy is greater than the threshold value, the next step is performed;

[0110] The cross-entropy loss function formula is as follows:

[0111]

[0112] Wherein, Loss represents the cross-entropy loss function, N represents the sample quantity, y i represents the sample true label, represents the sample prediction label.

[0113] In the embodiment, the steps of the adaptive comprehensive oversampling algorithm are as follows:

[0114] S201: calculating the ratio d of the minority class samples and the majority class samples;

[0115]

[0116] In the formula, m s represents the number of minority class samples, m l represents the number of majority class samples;

[0117] S202: calculating the total number G of the minority class samples to be generated;

[0118] G = (m l -m s ) x β

[0119] wherein β is the ratio of minority class samples to majority class samples; β = 1 indicates that the adaptive comprehensive oversampling algorithm obtains a completely balanced dataset of minority class samples and majority class samples after execution;

[0120] S203: Calculate k neighbors for the minority class samples using the Euclidean distance, Δ i is the number of majority class samples in the k neighbors, and the proportion r i of majority class samples in each specific neighborhood is calculated.

[0121]

[0122] S204: Normalize the r i values so that the sum of all r i values is equal to 1;

[0123]

[0124]

[0125] S205: Calculate the number of synthetic samples g i for each minority class sample;

[0126]

[0127] Since r i has a higher value in the neighborhood dominated by majority class samples, more synthetic minority class samples will be generated for these neighborhoods;

[0128] S206: Generate synthetic minority class samples s i ;

[0129] s i = x i + (x zi - x i ) x λ

[0130] wherein λ is a random number and satisfies λ ∈ [0, 1]; x i represents the current minority class sample, and x zi represents a random minority class sample in the k neighborhood.

[0131] The adaptive comprehensive oversampling algorithm not only achieves data enhancement, but also expands the small proportion of botnet traffic samples in the dataset before processing, balances the percentage of majority class samples and minority class samples, and improves the detection ability of the botnet detection model for minority class samples.

[0132] In the embodiment, the steps of the principal component analysis method are as follows:

[0133] S211: normalize the feature vector using the min-max method, so that all data is distributed in [0, 1], and the calculation formula is:

[0134]

[0135] In the formula, X is the original feature data, X max is the maximum value before feature normalization, and X min is the minimum value before feature normalization.

[0136] S212: calculate the covariance matrix of the features in the data set;

[0137] S213: run the characteristic equation of the covariance matrix, extract all eigenvalues, arrange the feature vectors in descending order according to the size of the corresponding eigenvalues, and mark them as λ1> λ2>... > λ n , solve the feature vectors according to the eigenvalues, and mark them as w1, w2,..., w n , wherein the characteristic equation is as follows:

[0138] R- λE = 0

[0139] S214: extract k principal components corresponding to the eigenvalues with a cumulative contribution rate of 80%-95%, and the cumulative contribution rate calculation formula is:

[0140]

[0141] Finally, the dimension-reduced feature matrix W = (w1, w2,..., w k ) is obtained.

[0142] The principal component analysis method realizes data dimension reduction, eliminates irrelevant and redundant features, reduces the number of features, and improves the accuracy of the botnet detection model; the principal component analysis method converts a large variable set into a smaller variable set, and the smaller variable set still includes most of the information in the large variable set; the principal component analysis method utilizes the correlation between data, reduces information loss during dimension reduction, and maximizes the information retained.

[0143] Embodiment 2

[0144] In the embodiment, as shown in Figure 2 , the botnet detection model comprises a convolutional neural network, an attention mechanism module, a bidirectional long short-term memory network, a fully connected layer, and an output layer connected in sequence.

[0145] The convolutional neural network is used to extract feature information of input data as input of the attention mechanism module.

[0146] The attention mechanism module is configured to reassign the weight of the channel according to the input feature information.

[0147] The bidirectional long short-term memory network is configured to learn the relationship between the features in the network traffic.

[0148] The fully connected layer is configured to map the feature information to a larger space, thereby increasing the representation ability of the botnet detection model.

[0149] The output layer is configured to output the detection classification result.

[0150] More specifically, the convolutional neural network comprises a first convolutional layer C1, a first pooling layer S1 and a second convolutional layer C2 connected in sequence.

[0151] The first convolutional layer C1 is composed of two 3*3 convolutional layers connected in series, which is used to replace a 5*5 convolutional layer, so as to effectively reduce the model parameters; the first pooling layer S1 is a maximum pooling layer or an average pooling layer; and the second convolutional layer C2 uses a 1*1 convolutional kernel.

[0152] Visual attention mechanism is a brain signal processing mechanism unique to human vision. Human vision obtains the target area that needs to be focused on by quickly scanning the global image, that is, the so-called attention focus, and then invests more attention resources in this area to obtain more detailed information of the target that needs to be focused on, while suppressing other useless information. This mechanism is applied to machine learning, which is embodied in that the attention mechanism in machine learning refers to learning the most important content in a picture, text or any data medium. The attention mechanism enables the neural network to have the ability to focus on some local important information of the input feature.

[0153] The attention mechanism module uses a convolutional block attention module.

[0154] The convolutional block attention module is used for two-dimensional data processing and is composed of a squeezing stage and an exciting stage.

[0155] In the squeezing stage, the traffic data feature map F is respectively extracted in the global average pooling layer and the maximum pooling layer from two different dimensions, and the feature information of the feature map is converted from the (c, w) dimension form to the (c, 1) dimension form, so as to obtain two compressed data, thereby obtaining the global information of each channel.

[0156] In the exciting stage, the compressed data is adaptively recalibrated by a multilayer perceptron, the weight of each channel of the feature map is assigned, two (c, 1) dimension feature maps are obtained, the two feature maps are added, and then a sigmoid activation function is used, and finally a weight vector M is obtained. C;M C The calculation formula is as follows:

[0157] M C = sigma(W(AvgPool(F))+W(MaxPool(F)))

[0158] In the formula, sigma represents a Sigmoid activation function, W represents a multilayer perceptron parameter, AvgPool represents an average pooling layer, MaxPool represents a maximum pooling layer, and F represents an input traffic data feature.

[0159] The bidirectional long short-term memory network comprises a first LSTM layer and a second LSTM layer; the first LSTM layer acquires input in a forward manner, and the second LSTM layer acquires input in a reverse manner.

[0160] The bidirectional long short-term memory network effectively increases the amount of information available to the network, improves the context information available to the algorithm, and further improves the detection accuracy of the botnet.

[0161] The long short-term memory network LSTM introduces a storage unit and a cell state to overcome the long-term dependence problem existing in the recurrent neural network RNN; the long-term dependence problem is a gradient explosion or gradient dispersion problem caused by multiple multiplications of matrices when the RNN calculates the relationship of a distant node.

[0162] The update of the first LSTM layer and the second LSTM layer at one time step is as follows:

[0163] i t = sigma(W xi x t +W hi h t-1 +b i )

[0164] f t = sigma(W xf x t +W hf h t-1 +b f )

[0165] o t = sigma(W xo x t +W ho h t-1 +b o )

[0166]

[0167]

[0168] h t= o t tanh(c t )

[0169] wherein, i t , f t and o t represent input gate, forget gate and output gate respectively; sigma and tanh represent two different activation functions respectively; c t represents the state of the current unit, c t-1 represents the state of the previous unit, represents the candidate memory unit; h t represents the hidden state of the current unit, h t-1 represents the hidden state of the previous unit.

[0170] The bidirectional long short-term network Bi-LSTM improves the predecessor of the LSTM by adding the backward hidden state to the existing forward hidden state , so that it obtains the forward-looking ability similar to the hidden Markov model.

[0171] The bidirectional long short-term memory network updates at a time step as follows:

[0172]

[0173]

[0174]

[0175] wherein, h t represents the hidden state of the current unit, h t-1 represents the hidden state of the previous unit, represents the forward hidden state of the current unit, represents the reverse hidden state of the current unit For network traffic, the bidirectional long short-term memory network utilizes the existing time characteristics to improve the training of the botnet detection model.

[0176] The Adam optimizer is used to calculate the updated step size, which absorbs the advantages of the adaptive learning rate gradient descent algorithm and the momentum gradient descent algorithm, can adapt to sparse gradient, can alleviate the problem of gradient shock, comprehensively considers the first-order moment estimation and second-order moment estimation of gradient, calculates the updated step size, is suitable for the training of the botnet detection model; the first-order moment estimation of gradient is the mean of gradient, and the second-order moment estimation of gradient is the variance of gradient;

[0177] More specifically, the full connection layer includes a first full connection layer FC1 and a second full connection layer FC2; the first full connection layer FC1 is composed of 32 neurons and outputs a 32-dimensional vector; the second full connection layer FC2 is composed of 16 neurons and outputs a 16-dimensional vector; the activation function used by the first full connection layer FC1 and the second full connection layer FC2 is a Relu function;

[0178] The activation function used by the output layer is a Sigmoid function, and the Sigmoid function is used to output the final botnet monitoring classification result, and the function calculation formula of the Sigmoid function is as follows:

[0179]

[0180] In the formula, x represents the weight accumulation of the previous full connection layer, and y represents the final botnet monitoring classification result probability value.

[0181] Embodiment 3

[0182] In this embodiment, the Wireshark tool is used to capture network data flow, the data flow of the network to be detected is preprocessed, the data flow is segmented according to the five-tuple, the flow statistical features capable of reflecting the communication and behavior characteristics of the botnet flow are extracted, and the non-numerical flow statistical features are one-hot encoded. According to the preprocessed network data flow, the network data flow is input into the trained botnet detection model classifier, the classifier classifies the network data flow to be detected, and the detection result of whether the network data flow to be detected is from the botnet is obtained.

[0183] The classifier classifies the network data flow to be detected, obtains the confusion matrix of the binary classification result, and the confusion matrix includes the binary classification accuracy, precision, recall and F1 score.

[0184] Obviously, the above embodiments of the present application are only examples for clearly illustrating the present application, and are not intended to limit the embodiments of the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the claims of the present application.

Claims

1. A botnet detection method based on an attention mechanism, characterized in that, The steps are as follows: S1: obtaining a data set, preprocessing the data set to obtain a preprocessed data set; the preprocessing method is as follows: according to the five-tuple, the flow data is segmented to obtain a single data stream set; extracting the flow statistical features in the single data stream set, and performing one-hot encoding on the non-numeric flow statistical features; using an adaptive comprehensive oversampling algorithm to realize data enhancement, and using a principal component analysis method to realize data dimension reduction; S2: constructing a botnet detection model based on an attention mechanism, and training according to the preprocessed data set; the botnet detection model comprises a convolutional neural network, an attention mechanism module, a bidirectional long short-term memory network, a full connection layer and an output layer connected in sequence; the convolutional neural network is used to extract feature information of the input data as the input of the attention mechanism module; the attention mechanism module is used to reassign the weights of the channels according to the input feature information; the bidirectional long short-term memory network is used to learn the relationship between the features in the network flow; the full connection layer is used to map the feature information to a larger space, thereby increasing the representation ability of the botnet detection model; the output layer is used to output the detection classification result; the attention mechanism module uses a convolution block attention module; the convolution block attention module is used for two-dimensional data processing and is composed of a squeezing stage and an exciting stage; in the squeezing stage, the flow data feature map F is respectively in a global average pooling layer and a maximum pooling layer, the feature information of the feature map is extracted from two different dimensions, and the (c, w) dimensional form is converted into a (c, 1) dimensional form, two compressed data are obtained, and the global information of each channel is obtained; In the excitation stage, the compressed data is adaptively recalibrated by the multi-layer perceptron, the weight assignment is performed on each channel of the feature map, two (c, 1) dimensional feature maps are obtained, the two feature maps are subjected to addition operation, then a sigmoid activation function is used, and finally a weight vector M is obtained C ; M C The calculation formula is as follows: M C = σ(W(AvgPool(F)) + W(MaxPool(F))) in the formula, σ represents a Sigmoid activation function, W represents a multilayer perceptron parameter, AvgPool represents an average pooling layer, MaxPool represents a maximum pooling layer, and F represents input flow data features; S3: capturing network data streams, and using the trained botnet detection model to determine whether the captured network data streams come from a botnet. 2.The botnet detection method based on attention mechanism according to claim 1, characterized in that, The method for training the constructed botnet detection model is as follows: the processed data set is divided into a training set and a test set, wherein the training set includes N kinds of botnet flow; the test set includes M kinds of botnet flow; M is greater than N, and N and M are positive integers; randomly initializing the parameters in the network, and one round of iterative training of the botnet detection model comprises one forward propagation and one backward propagation; the forward propagation process is as follows: the training set is transmitted layer by layer through the entire botnet detection model to obtain corresponding feature values and obtain a prediction structure; the actual result and the prediction result are used as the input of a cross-entropy loss function, the error between the actual result and the prediction result is calculated, and a loss value is obtained; the backward propagation process is as follows: based on the obtained loss value, the gradients of the parameters of the botnet detection model are calculated, and the parameters of the botnet detection model are updated according to the corresponding gradients; After multiple rounds of iterative training, a botnet detection model to be tested is obtained, the test set is input into the botnet detection model to be tested for testing, and the accuracy of the botnet detection model is detected; if the accuracy is less than a threshold, training is performed, and if the accuracy is greater than the threshold, the next step is performed; The cross-entropy loss function formula is as follows: wherein Loss represents a cross-entropy loss function, N represents a number of samples, y i represents a sample true label, represents a sample predicted label. 3.The botnet detection method based on attention mechanism according to claim 1, characterized in that, The five-tuple includes a source IP, a source port, a destination IP, a destination port, and a communication protocol. 4.The botnet detection method based on attention mechanism of claim 1, wherein, The adaptive comprehensive oversampling algorithm comprises the following steps: S201: Calculate the ratio d of the minority class samples and the majority class samples. where m s denotes the number of minority class samples, m l denotes the number of majority class samples; S202: Calculate the total number G of the minority class samples to be generated. G = (m l -m s ) x β In the formula, β is the ratio of the minority class samples and the majority class samples; β = 1 indicates that the adaptive comprehensive oversampling algorithm obtains a completely balanced data set of the minority class samples and the majority class samples after execution. S203: Calculate k neighbors for minority class samples using Euclidean distance, Δ i is the number of majority class samples in k neighbors, and r is the proportion of majority class samples in each specific neighborhood i ; S204: Normalize the r i values so that the sum of all r i values is equal to 1. S205: Calculate the number of synthetic samples g for each minority class sample i ; Since r i The neighborhood median is higher in the neighborhoods that are dominated by the majority class, so more synthetic minority class samples will be generated for these neighborhoods; S206: generating a synthetic minority class sample s i ; s i = x i + (x zi - x i ) x l where λ is a random number and satisfies λ ∈ [0, 1]; x i represents the current minority class sample, x zi represents a random minority class sample within the k neighborhood.

5. The botnet detection method based on attention mechanism according to claim 4, characterized in that, The principal component analysis method comprises the following steps: S211: Standardize the feature vectors using the min-max method, so that all data is distributed in [0, 1], and the calculation formula is as follows: In the formula, X is the original feature data, X max is the maximum value before feature standardization, X min is the minimum value before feature standardization; S212: Calculate the covariance matrix of the features in the data set. S213: Run the eigen equation of the covariance matrix, extract all eigenvalues, and arrange the eigenvectors in descending order according to the size of the corresponding eigenvalues, denoted as λ1> λ2>... > λ n , solve the eigenvectors according to the eigenvalues, denoted as w1, w2,..., w n , where the eigen equation is as follows: R-λE = 0 S214: Extract k principal components corresponding to the feature values between 80% and 95% of the cumulative contribution rate, and the cumulative contribution rate calculation formula is as follows: The final dimension-reduced feature matrix W = (w1, w2,..., wn) is obtained. k ).

6. The botnet detection method based on attention mechanism according to claim 1, characterized in that, The convolutional neural network comprises a first convolutional layer C1, a first pooling layer S1, and a second convolutional layer C2 connected in sequence. The first convolutional layer C1 is composed of two 3x3 convolutional layers connected in series; the first pooling layer S1 is a maximum pooling layer or an average pooling layer; and the second convolutional layer C2 uses a 1x1 convolutional kernel.

7. The botnet detection method based on attention mechanism according to claim 6, characterized in that, The bidirectional long short-term memory network comprises a first LSTM layer and a second LSTM layer. The first LSTM layer acquires input in a forward direction, and the second LSTM layer acquires input in a reverse direction. The update of the first LSTM layer and the second LSTM layer at one time step is as follows: i t = σ(W xi x t + W hi h t-1 + b i ) f t = σ(W xf x t + W hf h t-1 + b f ) o t = σ(W xo x t + W ho h t-1 + b o ) h t = o t tan h(c t ) wherein, i t , f t and o t represent input gate, forget gate and output gate respectively; sigma and tanh represent two different activation functions respectively; c t represents the state of the current unit, c t-1 represents the state of the previous unit, represents a candidate memory unit; h t represents the hidden state of the current unit, h t-1 represents the hidden state of the previous unit; The update of the bidirectional long short-term memory network at one time step is as follows: where h t represents the hidden state of the current unit, h t-1 represents the hidden state of the previous unit, represents the forward hidden state of the current unit, represents the backward hidden state of the current unit. For network traffic, the bidirectional long short-term memory network utilizes the existing time characteristics to improve the training of the botnet detection model. 8.The botnet detection method based on attention mechanism of claim 1, wherein, The fully connected layer comprises a first fully connected layer FC1 and a second fully connected layer FC2; the first fully connected layer FC1 is composed of 32 neurons and outputs a 32-dimensional vector; the second fully connected layer FC2 is composed of 16 neurons and outputs a 16-dimensional vector; and the activation functions used by the first fully connected layer FC1 and the second fully connected layer FC2 are both Relu functions. The activation function used by the output layer is a Sigmoid function, which outputs the final botnet monitoring classification result, and the function calculation formula of the Sigmoid function is as follows: In the formula, x represents the weight accumulation of the previous fully connected layer, and y represents the probability value of the final botnet monitoring classification result.

Images