Twin network unknown traffic identification method based on soft edge triplet loss function

Abstract

The application discloses a kind of twin network unknown flow identification method based on soft edge triplet loss function, comprising: the triplet data set of twin network training demand is constructed, is formed in the way of random construction, through multiple iterations, form a variety of combined triplet training data set;In the model training stage, soft boundary triplet loss function guides model training, and the twin network after training is used as an encoder;Using the encoder encodes the test sample and all known flow data samples;The distance of test sample and known flow application is calculated, and whether it belongs to unknown sample is determined by comparing with preset threshold;The sample determined as unknown flow is clustered by similarity, and higher purity cluster is formed;According to cluster purity, the best number of clustering is determined, and finally fine-grained analysis is carried out.The application solves the problems of traditional unsupervised clustering scheme and deep learning scheme in unknown flow identification field, such as unclear clustering number and too many maintenance models.

Description

Technical Field

[0001] This invention relates to the fields of network artificial intelligence, unknown traffic identification, and unknown traffic clustering, and in particular to a method for identifying unknown traffic in twin networks based on the soft edge triplet loss function. Background Technology

[0002] Unknown traffic identification is crucial for network security management and network resource optimization. Operators or network administrators can identify potential unknown malicious traffic or network attacks. Simultaneously, they can perform fine-grained network resource allocation and dynamic intelligent regulation of the identified traffic to support the development of services such as network slicing and customizable network services. Therefore, achieving fine-grained unknown traffic identification can promote efficient use of network resources, reduce network energy consumption, and mitigate potential network security risks.

[0003] Unknown network traffic identification mainly includes two stages: unknown traffic detection and unknown traffic clustering. The former ensures that unknown application traffic can be detected and distinguished from known types with a certain confidence level, avoiding confusion between unknown traffic and known types, which could lead to some hidden security risks or hinder targeted network resource optimization. The latter ensures that the identified unknown traffic is clustered into clusters with higher purity based on their similarity, allowing for the introduction of expert systems (professional systems composed of technicians with background knowledge in traffic identification, assisted by traditional or artificial intelligence technologies, to further improve the accuracy of identification) and deep packet inspection techniques to further analyze the types of unknown traffic, enrich the known sample library, and thus improve the accuracy of network traffic identification.

[0004] Traditional unknown traffic identification schemes are mainly divided into the following three types: (1) Unsupervised clustering-based identification methods directly perform unsupervised clustering on all traffic samples according to selected features, which usually results in unknown traffic not being effectively distinguished and the number of clusters being uncertain; (2) Semi-supervised clustering-based identification methods usually introduce some labeled samples to guide the clustering process. This approach can lead to unknown traffic samples being swallowed up by known traffic samples, resulting in decreased identification accuracy and contamination of known samples; (3) One-class-based identification methods construct a binary classifier for any known traffic category to determine whether the sample belongs to that category. If all binary classifications determine it as no, the sample is determined as unknown. This method has too much overhead. When there are thousands of applications in the actual network environment, too many binary classifiers need to be maintained. Summary of the Invention

[0005] The purpose of this invention is to solve the aforementioned problems existing in traditional unknown traffic identification schemes.

[0006] To achieve the above objectives, this invention provides a method for identifying unknown traffic in Siamese networks based on a soft-edge triplet loss function. This method includes the following steps:

[0007] To construct a triplet dataset for Siamese network training, a random construction method is used, and through multiple rounds of iteration, a variety of triplet training datasets are formed.

[0008] During the training phase of the Siamese network model, the soft-boundary triplet loss function guides the training of the Siamese network model. After training, the Siamese network is used as an encoder. The encoder is used to encode the test sample and all known traffic data samples. The distance between the test sample and the known traffic applications is calculated, and it is determined whether it belongs to an unknown sample by comparing it with a preset threshold.

[0009] Samples identified as unknown traffic are clustered by similarity to form clusters with higher purity; the optimal number of clusters is determined based on the cluster purity, and finally an expert system is introduced for fine-grained analysis.

[0010] This invention employs the concept of policy learning to address the problems of unclear clustering numbers and excessive maintenance of Siamese network models in the field of unknown traffic identification, which are inherent in traditional unsupervised clustering schemes and deep learning schemes. During the training phase, under the constraint of a soft-boundary triplet loss function, the distance between samples of the same category is shortened, while the distance between samples of different categories is increased during inference. This makes the boundaries between different categories of traffic data more distinct in the new mapping space, thereby improving identification accuracy. Attached Figure Description

[0011] Figure 1 A schematic flowchart of a twin network unknown traffic identification method based on soft edge triplet loss function provided for the implementation of this invention;

[0012] Figure 2 for Figure 1 The diagram shows the architecture of the twin network unknown traffic identification scheme based on the soft edge triplet loss function in the method shown.

[0013] Figure 3 This is a diagram illustrating the performance comparison results. Detailed Implementation

[0014] Exemplary embodiments of this disclosure will now be described in more detail with reference to the foregoing description. While these embodiments illustrate exemplary embodiments of this disclosure, it should be understood that this disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of this disclosure to those skilled in the art.

[0015] This invention provides a twin network unknown traffic identification scheme based on a soft-edge triplet loss function. The core idea of ​​this scheme is to shorten the spatial distance between samples of the same category and widen the spatial distance between samples of different categories, ultimately making the spatial boundaries of clusters of different categories of samples clearer and preventing overlap. Then, the distance between the sample to be tested and each known traffic cluster is compared with a defined threshold to determine whether the sample to be tested is known.

[0016] Figure 1 This is a schematic flowchart illustrating a method for identifying unknown traffic in a Siamese network based on a soft-edge triplet loss function, provided for the implementation of this invention. Figure 1 As shown, the method includes steps S101-S103:

[0017] Step S01: Construct a triplet dataset for training the Siamese network model. The dataset is constructed randomly and through multiple iterations to form training datasets with various combinations of triplets.

[0018] Specifically, the embodiments of the present invention include two processes: Siamese network model training and unknown traffic identification. The Siamese network model training process mainly includes the design of soft-boundary triple loss function and the construction of training triple data.

[0019] The design of the soft-boundary triplet loss function is the core of this solution. The loss function designed in this embodiment is defined as follows:

[0020]

[0021] Among them, (x a x p x n ) represents an input triple, (x a x p (x) represents two samples from the same traffic category but different samples. a x n ) represents samples from different categories; D(x) a x p S(x) represents the Euclidean distance between two samples; S(x) = ln(e x +1) represents the soft-boundary activation function; the parameters N, m1, m2, and β represent the total number of samples, the inter-class distance, the intra-class distance, and the intra-class distance weighting, respectively. This loss function guides the optimization of the Siamese neural network, specifically, making (x a x p The distance is brought closer and less than the intraclass spacing m2, so that (x a x n The distance between classes is increased and becomes greater than the inter-class distance m1.

[0022] The dataset for training triples is constructed and used as input for training the Siamese network model. Guided by the loss function, the Siamese network model learns from the triple data and optimizes itself. The triple construction process is as follows:

[0023] i. For any known flow data sample x a Randomly select a different sample x from its own category of traffic samples. p x is randomly selected from all traffic samples of its different categories. n This forms a triple (x a x p x n );

[0024] ii. Repeat step one for all known traffic samples;

[0025] iii. Set the number of iterations E, and iterate processes i and ii E times to generate training data with different combinations of triples.

[0026] Step S02: During the Siamese network model training phase, the soft-boundary triplet loss function guides the training of the Siamese network model. After training, the Siamese network is used as an encoder. The encoder is used to encode the test sample and all known traffic data samples. The distance between the test sample and the known traffic application is calculated, and it is determined whether it belongs to an unknown sample by comparing it with a preset threshold.

[0027] Specifically, the unknown traffic identification stage: The main purpose of this stage is to distinguish unknown traffic from known traffic samples. The identification process is as follows:

[0028] For each sample in each known traffic category, the trained Siamese network is used to encode it; the cluster center of each category is calculated using Euclidean distance, and the k samples closest to the cluster center are selected as representative samples of each known category;

[0029] The test sample is encoded using a Siamese network model, and then the average distance between the test sample and k representative samples of each known application category is calculated.

[0030] Set a distance threshold T. If the distance between the tested sample and all known categories is greater than the threshold T, the sample is determined to be unknown traffic; otherwise, the traffic label corresponding to the shortest distance is set as the traffic type of the sample.

[0031] Step S03 involves clustering samples identified as unknown traffic using similarity to form clusters with higher purity; the optimal number of clusters is determined based on the cluster purity. This embodiment of the invention still supports user-defined unsupervised clustering algorithms during the clustering stage, such as K-means, spectral clustering, and graph clustering. The optimal number of clusters is determined based on cluster purity, and finally, an expert system is introduced for fine-grained analysis.

[0032] Specifically, the clustering process mainly includes an identification phase and a clustering phase, and its core working principle is as follows:

[0033] The main purpose of the unknown traffic clustering stage is to cluster samples identified as unknown traffic based on similarity, forming clusters with higher purity. The clustering process is as follows:

[0034] For unknown traffic samples that have already been encoded by the twin network model, deploy an unsupervised clustering algorithm;

[0035] Calculate the optimal cluster value by calculating the purity within the cluster and selecting the value corresponding to the highest purity as the optimal cluster value;

[0036] Further analysis was completed by introducing subsequent expert systems and deep packet inspection technology.

[0037] This invention was experimentally verified on the real network traffic dataset ISCX-VPN, which covers 18 fine-grained applications or application activities, as shown in Table 1. To simulate an unknown traffic identification environment, three sets of test cases were constructed in this experiment. In each set of test cases, some applications were randomly selected as unknown applications, and the remaining applications were used as known applications to train the Siamese neural network. The construction of the three sets of test cases is shown in Table 2.

[0038] Table 1. Specific Application Categories of the ISCX VPN Dataset

[0039] Youtube Facebook Audio Email ICQ_Chat Hangouts_Audio Vimeo AIM_CHAT Spotify Hangouts_Chat Bittorrent Facebook_chat FTPS SFTP Skype Audio Skype Files Netflix Skype Chat Voipbuster

[0040] Table 2 Test Cases

[0041]

[0042] In the identification phase, purity (PR), accuracy (ACC), positive example detection rate (TDR), and negative example detection rate (FDR) were selected to test the performance of the scheme in this embodiment of the invention. PR, ACC, TDR, and FDR all have values ​​in the range [0,1], with 1 representing optimal performance for the first three and 0 representing optimal performance for FDR. The criterion for judging the scheme's performance is that PR, ACC, and TDR should be as high as possible, while ensuring that FDR is as low as possible. The scheme in this embodiment of the invention (LSN-SMTL) selected the current state-of-the-art method (SEEN) for experimental comparison, and the specific results are as follows: Figure 2As shown, the embodiment of the present invention significantly outperforms SEEN in all three test cases, with an average improvement of 25.8% in accuracy (ACC) across the three test cases.

[0043] In the clustering stage, intra-cluster purity (CP) is selected as the evaluation index, indicating the clustering effect of the Siamese network model encoder on traffic samples in the new mapping space. CP takes the value [0,1], where 1 indicates that the data samples in each cluster belong to the same category, resulting in the best performance. The clustering experiment results for the three test cases are shown in Table 3. The intra-cluster purity index of this embodiment is improved by an average of 13.1% across the three test cases.

[0044] Table 3 Comparison of intra-cluster purity (CP) results of the Siamese network model encoder after encoding the data samples

[0045] Test Case Index SEEN encoding LSN-SMTL encoding TC1 0.502 0.604 TC2 0.760 0.902 TC3 0.586 0.589

[0046] It should be noted that:

[0047] The algorithms and displays provided herein are not inherently related to any particular computer, virtual device, or other equipment. Various general-purpose devices can also be used in conjunction with the teachings herein. The required structure for constructing such devices is readily apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the invention described herein can be implemented using various programming languages, and the above descriptions of specific languages ​​and system function modules are merely for disclosing the best mode of implementation of the invention.

[0048] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if such modifications and variations fall within the scope of the claims of this invention and its equivalents, this invention also intends to include such modifications and variations.

Claims

1. A method for identifying unknown traffic in Siamese networks based on the soft-edge triplet loss function, characterized in that, Includes the following steps: To construct the triplet dataset required for training the Siamese network model, a random construction method was adopted, and through multiple rounds of iteration, a training dataset with various combinations of triplets was formed. During the training phase of the Siamese network model, the soft-boundary triplet loss function guides the training of the Siamese network model, and the trained Siamese network is used as an encoder on its own. The encoder is used to encode the sample under test with all known traffic data samples; the distance between the sample under test and known traffic applications is calculated, and its status as an unknown sample is determined by comparing it with a preset threshold. Samples identified as unknown traffic are clustered based on similarity to form clusters with higher purity; The optimal number of clusters is determined based on cluster purity, and an expert system is ultimately introduced for fine-grained analysis. The training process of a Siamese network model mainly involves the design of a soft-boundary triplet loss function, which is defined as: Among them, (x a ,x p ,x n ) represents an input triple, (x a ,x p (x) represents two samples from the same traffic category but different samples. a ,x n ) represents samples from different categories; D(x) a ,x p ) represents two samples x a ,x p The Euclidean distance between them; D(x) a ,x n ) represents two samples x a ,x n The Euclidean distance between them; S(x) = ln(e x +1) represents the soft-boundary activation function; parameters N, m1, m2, and β represent the total number of samples, inter-class distance, intra-class distance, and intra-class distance weight, respectively; this loss function guides the optimization of the Siamese neural network, making (x a ,x p The distance is brought closer and less than the intraclass spacing m2, so that (x a ,x n The distance between classes is increased and becomes greater than the inter-class distance m1.

2. The method according to claim 1, characterized in that, The dataset for training triples is constructed and used as input for training the Siamese network model. Guided by the loss function, the Siamese network model learns the triple data information and optimizes the Siamese network model.

3. The method according to claim 2, characterized in that, The triplet construction steps include: Step 1: For any known flow data sample x a Randomly select a different sample x from its own category of traffic samples. p x is randomly selected from all traffic samples of its different categories. n This forms a triple (x a ,x p ,x n ); Step 2: Repeat Step 1 for all known traffic samples; Step 3: Set the number of iterations E, and iterate Step 1 and Step 2 E times to generate training data with different combinations of triples.

4. The method according to claim 1, characterized in that, The steps for determining whether a test sample is an unknown sample include: For each sample in each known traffic category, the trained Siamese network is used to encode it; the cluster center of each category is calculated using Euclidean distance, and the k samples closest to the cluster center are selected as representative samples of each known category; The test sample is encoded using a Siamese network, and then the average distance between the test sample and k representative samples of each known application category is calculated. Set a distance threshold T. If the distance between the tested sample and all known categories is greater than the threshold T, the sample is determined to be unknown traffic; otherwise, the traffic label corresponding to the shortest distance is set as the traffic type of the sample.

5. The method according to claim 1, characterized in that, For unknown traffic samples that have already been encoded by twin networks, an unsupervised clustering algorithm is deployed; the optimal cluster value is calculated, and the value with the highest purity is selected as the optimal cluster value by calculating the purity within the cluster; a subsequent expert system is introduced to complete further analysis.

6. The method according to claim 1, characterized in that, The clustering phase supports user-defined unsupervised clustering algorithms, including K-means, spectral clustering, and graph clustering.

Images