Feature extraction, determination and training methods, devices, equipment and media

Abstract

The present application discloses a method, apparatus, device and medium for feature extraction, determination and training, wherein the method comprises: analyzing data packets in traffic data to obtain session identifiers of the data packets; parsing the data packets in the traffic data based on the session identifiers to obtain parsing results; and extracting features from the data in the parsing results to obtain feature extraction results of the traffic data.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method, apparatus, device and medium for feature extraction, determination and training. Background Art

[0002] Although relevant technologies can extract some traffic features from network traffic data, these traffic features cannot fully and accurately display the overall information contained in the network traffic data. Summary of the Invention

[0003] Based on the above problems, the embodiments of the present application provide a feature extraction, determination and training method, device, equipment and medium.

[0004] The technical solution provided by the embodiments of this application is as follows:

[0005] The present invention first provides a feature extraction method, which includes:

[0006] Analyzing data packets in the traffic data to obtain session identifiers of the data packets;

[0007] Parsing the data packets in the traffic data based on the session identifier to obtain a parsing result;

[0008] Feature extraction is performed on the data in the analysis result to obtain a feature extraction result of the flow data.

[0009] In some embodiments, extracting features from the data in the analysis result to obtain feature extraction results of the traffic data includes:

[0010] Performing contextual semantic feature extraction on the kth data to obtain a kth feature extraction result associated with the mth session identifier; wherein the kth data includes at least a portion of the data associated with the mth session identifier in the parsing result; and m and k are both integers greater than or equal to 1;

[0011] Based on the kth feature extraction result associated with the mth session identifier, a feature extraction result of the traffic data is determined.

[0012] In some embodiments, before extracting contextual semantic features from the kth data, the method further includes:

[0013] Acquire data associated with the mth session identifier from the parsing result;

[0014] Obtaining kth initial data from the data associated with the mth session identifier through a sliding window; wherein the kth initial data includes data obtained for the kth time from the data associated with the mth session identifier;

[0015] The mth session identifier is associated with the kth initial data to obtain the kth data.

[0016] In some embodiments, determining the feature extraction result of the traffic data based on the kth feature extraction result associated with the mth session identifier includes:

[0017] Get the weight set;

[0018] Based on the weight set, feature extraction results associated with the first session identifier to the feature extraction results associated with the Mth session identifier are processed to obtain feature extraction results of the traffic data; wherein M includes the number of identifiers in the session identifier.

[0019] In some embodiments, analyzing a data packet in the traffic data to obtain a session identifier of the data packet includes:

[0020] Obtaining at least address information and protocol information from the data packet;

[0021] The address information and the protocol information are analyzed to obtain a session identifier of the data packet.

[0022] Based on the foregoing embodiment, the present application further provides a determination method, which includes:

[0023] Analyzing data packets in the traffic data to obtain session identifiers of the data packets;

[0024] Parsing the data packets in the traffic data based on the session identifier to obtain a parsing result;

[0025] Performing feature extraction on the data in the analysis result to obtain a feature extraction result of the traffic data;

[0026] Based on the feature extraction result, a security status of the traffic data is determined.

[0027] Based on the above embodiments, the present application also provides a training method, which includes:

[0028] Analyzing data packets in the traffic data to obtain session identifiers of the data packets;

[0029] Parsing the data packets in the traffic data based on the session identifier to obtain a parsing result;

[0030] Performing feature extraction on the data in the analysis result to obtain a feature extraction result of the traffic data;

[0031] The initial feature extraction model is trained based on the feature extraction result to obtain a feature extraction model.

[0032] The present application also provides a feature extraction device, comprising:

[0033] A processing module, configured to analyze data packets in the flow data to obtain session identifiers of the data packets; and parse the data packets in the flow data based on the session identifiers to obtain parsing results;

[0034] The feature extraction module is used to extract features from the data in the analysis result to obtain feature extraction results of the traffic data.

[0035] An embodiment of the present application also provides an electronic device, which includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, it can implement any of the feature extraction methods, determination methods, and training methods described above.

[0036] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor of an electronic device, it can implement any of the feature extraction methods, determination methods, and training methods described above.

[0037] The feature extraction method provided in the embodiment of the present application analyzes the data packets in the traffic data to obtain the session identifier of the data packets, which can provide an accurate session identification basis for the subsequent parsing of the data packets in the network data; and, based on the session identifier, the data packets in the traffic data are parsed so that the data in the parsing result can be associated with the session identifier, that is, the data in the parsing result can fully include the data packets included in the session corresponding to the session identifier, thereby improving the integrity of the data packets in the parsing result at the session granularity; at the same time, feature extraction is performed on the data in the parsing result, and the feature extraction result of the traffic data obtained can comprehensively, time-relatedly, and accurately display the feature change status of the data packets of the session corresponding to the session identifier. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of a flow chart of a feature extraction method provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of a process for obtaining k-th data provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of a process for obtaining analysis results provided in an embodiment of the present application;

[0041] Figure 4Another schematic diagram of a flow chart of a feature extraction method provided in an embodiment of the present application;

[0042] Figure 5 A flowchart of a determination method provided in an embodiment of the present application;

[0043] Figure 6 A flowchart of the training method provided in an embodiment of the present application;

[0044] Figure 7 A schematic diagram of the structure of a feature extraction device provided in an embodiment of the present application;

[0045] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application.

[0047] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0048] With the rapid development of network technology, network traffic has experienced explosive growth. Network traffic contains a variety of information during data transmission, such as interaction information between devices. Therefore, network traffic analysis, such as network traffic feature extraction, is a key prerequisite for network bandwidth planning, network intrusion detection and prevention, Internet of Things (IoT) asset identification, and malicious traffic detection.

[0049] However, due to the encryption and randomness of network traffic, the analysis and feature extraction of network traffic face huge challenges.

[0050] In practical applications, by analyzing network traffic characteristics based on network application type or protocol type, we can extract some effective data features from network traffic. Common network traffic feature analysis methods include port-based traffic analysis, payload-based traffic analysis, traffic behavior-based traffic analysis, and machine learning-based traffic analysis.

[0051] However, although the port-based traffic analysis method can obtain port-related features, it has gradually become ineffective due to the widespread use of random ports and port masquerading technology; the payload-based traffic analysis method extracts valid string information from the network traffic payload and uses a string matching algorithm to extract payload features from the network traffic, but this method cannot handle encrypted traffic or traffic from other network applications, which greatly reduces the effectiveness and accuracy of the payload features; the traffic behavior-based traffic analysis method can identify network traffic through device interaction behavior information and obtain characteristics between data packets such as data packet transmission time and data packet size, but the implementation model of this method is relatively complex, real-time performance cannot be guaranteed, and application types cannot be identified in a refined manner; the machine learning-based traffic analysis method can extract some key features from network traffic, such as the underlying features of the protocol, and the accuracy of feature recognition has been improved, but this method cannot accurately determine the effective features and is prone to feature redundancy.

[0052] From the above, it can be seen that although the traffic feature analysis method in the related art can obtain some features contained in the network traffic, these features cannot fully and accurately reflect the overall features carried by the network traffic.

[0053] Based on the above problems, the embodiments of the present application provide a feature extraction, determination and training method, device, equipment and medium.

[0054] The feature extraction method provided in the embodiments of the present application can be implemented by a processor of an electronic device. The processor can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, and a microprocessor.

[0055] Illustratively, the electronic device may be a computer device, such as a personal computer or a server device.

[0056] Exemplarily, the electronic device may be a virtual machine device or a physical machine device, which is not limited in the embodiments of the present application.

[0057] Figure 1 A flow chart of the feature extraction method provided in the embodiment of the present application is shown in FIG. Figure 1 As shown, the method may include the following steps:

[0058] Step 101: Analyze the data packets in the traffic data to obtain the session identifiers of the data packets.

[0059] In one embodiment, traffic data can be obtained in real time; exemplarily, the data transmission and reception process of any of the terminal devices, intermediate devices, and network devices can be monitored by a packet capture tool to obtain traffic data; exemplarily, the terminal device can include a computer device; exemplarily, the terminal device can include a mobile terminal device, such as a smart phone, a smart wearable device, etc.; exemplarily, the intermediate device can include a device for connecting the terminal device and the network device, such as a security protection device; exemplarily, the network device can include a device for processing data processing requests initiated by the terminal device, such as a server device, etc.; exemplarily, the server device can include an Internet of Things (IoT) device.

[0060] In one embodiment, the traffic data can be acquired in advance, that is, the traffic data can be traffic data within a historical moment or a historical period. The traffic data at this time can be stored in a file. Therefore, the analysis operation of the data packets in the traffic data can be achieved by file parsing.

[0061] In one embodiment, a data packet may be a basic component unit of traffic data; illustratively, a data packet may be a basic data transmission unit specified in a standard data transmission protocol, for example, a data packet may be a packet in the Transmission Control Protocol (TCP).

[0062] In one embodiment, the number of data packets in the traffic data may be multiple.

[0063] In one embodiment, the session identifier of the data packet may include an identifier that can represent the session information of the data packet; exemplarily, the session identifier may include at least one of the name, number, establishment time, duration, initiating device, and responding device of the session in which the data packet is located; exemplarily, the session identifier may include a Session ID.

[0064] In one embodiment, the session identifier may be obtained by any of the following methods:

[0065] The session identifier may be included in a data packet of the traffic data. Therefore, the session identifier may be obtained by analyzing the data packet.

[0066] The fields associated with the session in the data packet of the traffic data are analyzed to obtain session-related data, and then the session-related data is parsed to determine the session identifier of the data packet; illustratively, the session-related data may include data stored in fields in the data packet that can characterize session characteristics.

[0067] Step 102: Parse the data packets in the traffic data based on the session identifier to obtain a parsing result.

[0068] In one embodiment, the parsing result can be obtained by any of the following methods:

[0069] The data packets in the traffic data are classified based on the session identifier to obtain a first result, and then the first result is traversed and parsed field by field to obtain a parsing result. That is, the data in the parsing result can be data packets classified according to the session identifier.

[0070] Data packets in the traffic data are classified and processed based on the session identifier to obtain a first result, and then the data packets in the first result are sorted based on time information contained in the data packets in the first result to obtain a sorted first result, and then the sorted first result is parsed to obtain a parsed result.

[0071] The data packets in the traffic data are session-tagged based on the session identifier to obtain a second result, and then the second result is traversed and parsed field by field to obtain a parsing result. At this time, the data in the parsing result may include the session identifier.

[0072] In one embodiment, the device corresponding to the traffic data can perform processing and / or transmission operations of data packets corresponding to a session represented by at least one session identifier. For example, each IOT device can process data packets of multiple sessions.

[0073] Step 103: Perform feature extraction on the data in the analysis result to obtain feature extraction results of the traffic data.

[0074] In one embodiment, the feature extraction results of the traffic data may include at least part of the features carried by the traffic data; exemplarily, at least part of the features may include features carried by at least part of the data packets associated with the session identifier; exemplarily, at least part of the features may include features carried by data corresponding to at least part of the fields of the data packets in the traffic data.

[0075] In one embodiment, the feature extraction result of the traffic data can be obtained by any of the following methods:

[0076] The data in the parsing result is subjected to feature extraction through a neural network to obtain a third result, and then the third result is associated with the session identifier corresponding to the parsing result, thereby obtaining feature extraction results of each session corresponding to the session identifier in the traffic data.

[0077] Feature extraction is performed on data in the parsing result including the session identifier through a neural network, the obtained fourth result is associated with the session identifier, and the fourth result is determined as a feature extraction result of the traffic data.

[0078] In related technologies, feature extraction operations on network data are performed at the packet level, which can lead to over-discrete and incomplete feature extraction results. In the embodiments of the present application, however, the feature extraction results of traffic data are obtained by extracting features from the data in the parsing results, and the parsing results are obtained by parsing the traffic data based on the session identifier of the packet. In other words, the parsing results are associated with the session identifier, so that the feature extraction results of the traffic data are also associated with the session identifier, thereby achieving session-level parsing and feature extraction of network data, so that the feature extraction results can more completely display the changing status of the session corresponding to the session identifier.

[0079] From the above, it can be seen that the feature extraction method provided in the embodiment of the present application, by analyzing the data packets in the traffic data, obtains the session identifier of the data packet, which can provide an accurate session identification basis for the subsequent parsing of the data packets in the network data; and, based on the session identifier, the data packets in the traffic data are parsed so that the data in the parsing result can be associated with the session identifier, that is, the data in the parsing result can fully include the data packets contained in the session corresponding to the session identifier, thereby improving the integrity of the data packets in the parsing result at the session granularity; at the same time, feature extraction is performed on the data in the parsing result, and the feature extraction result of the traffic data obtained can comprehensively, time-relatedly, and accurately display the feature change status of the data packets of the session corresponding to the session identifier.

[0080] Based on the above embodiments, in the feature extraction method provided in the embodiments of the present application, feature extraction is performed on the data in the analysis results to obtain feature extraction results of the traffic data, which can be achieved by the following methods:

[0081] Context semantic features are extracted for the kth data to obtain a kth feature extraction result associated with the mth session identifier; and a feature extraction result of the traffic data is determined based on the kth feature extraction result associated with the mth session identifier.

[0082] The kth data includes at least part of the data associated with the mth session identifier in the parsing result; m and k are both integers greater than or equal to 1.

[0083] In one embodiment, a semantic extraction model may be used to extract contextual semantic features from the k-th data.

[0084] In one embodiment, the semantic extraction model may include a neural network model capable of realizing contextual semantic feature extraction and semantic feature fusion; exemplarily, semantic feature extraction may include the function of extracting semantic features from text, numbers, pictures or images; exemplarily, semantic feature fusion may include the function of fusing semantic feature extraction results; exemplarily, the above-mentioned semantic extraction model may include word2vec, or a continuous bag of words model (CBOW) such as in word2vec.

[0085] In one embodiment, sample network data containing normal data transmission and abnormal data transmission status can be obtained in advance, and the session identifier can be obtained from the data packet of the sample network data through the method provided in the aforementioned embodiment. Then, the sample network data is parsed based on the session identifier to obtain the sample parsing result, and then the initial semantic extraction model is trained based on the sample parsing result, so that the initial semantic model can adaptively learn the session features during the processing of the sample parsing result, and synchronously adjust the parameters of the initial semantic model, thereby obtaining the semantic extraction model required in the embodiment of the present application.

[0086] In practical applications, there are also some methods for extracting feature information from network data using machine learning models. However, the training process of these machine learning models requires a lot of expert experience, and the feature construction process used to support the above training process is cumbersome. If the application scenario of the network data is switched, the feature samples need to be reconstructed, which leads to an exponential increase in time cost, labor cost and computing cost. Moreover, in the actual training process, due to the excessive granularity of the features, it is easy to cause feature redundancy.

[0087] The semantic extraction model used in the embodiments of the present application can adaptively extract contextual features, so it can adaptively adjust the learning direction and model weights based on limited sample data, thereby reducing dependence on expert experience and reducing the time, manpower and computing costs of model training; and, with the help of the self-learning ability of the semantic extraction model, it can adaptively switch in network data in any application scenario, and can also improve the accuracy of feature extraction results.

[0088] In one implementation, the number of identifiers in the mth session identifier may be at least one.

[0089] In one implementation, the kth data may not include the mth session identifier.

[0090] In one embodiment, the kth data may be obtained by any of the following methods:

[0091] A selection result is obtained by randomly selecting at least a portion of the data packets associated with the mth session identifier, and the selection result is determined as the kth data; illustratively, the above-mentioned random selection process may include selecting the data packets associated with the mth session identifier at random time intervals or data packet intervals.

[0092] A data packet within a specified time period is selected from the data packets associated with the mth session identifier, and the selected data packet is determined as the kth data.

[0093] In one embodiment, the kth feature extraction result associated with the mth session identifier can be obtained by any of the following methods:

[0094] The mth session identifier and the kth data are respectively input into the semantic extraction model, and the output data of the semantic extraction model is determined as the kth feature extraction result associated with the mth session identifier.

[0095] The kth data is input into the semantic extraction model to obtain output data of the semantic extraction model, the mth session identifier is associated with the output data, and the association result is determined as the kth feature extraction result associated with the mth session identifier.

[0096] In one embodiment, the feature extraction result of the traffic data can be determined by:

[0097] All feature extraction results associated with the mth session identifier are integrated to obtain a feature extraction result associated with the mth session identifier, and then the feature extraction results associated with each session identifier are fused, and the fusion result is determined as the feature extraction result of the traffic data.

[0098] From the above, it can be seen that the feature extraction method provided in the embodiment of the present application can fully extract the context information contained in the kth data by performing context feature extraction on the kth data, thereby improving the comprehensiveness and completeness of the features contained in the kth feature extraction result associated with the mth session identifier; and, since the kth data is associated with the mth session identifier, the kth feature extraction result associated with the mth session identifier can comprehensively and accurately reflect the feature information of the data packets contained in the session corresponding to the mth session identifier; at the same time, based on the kth feature extraction result associated with the mth session identifier and the feature extraction result of the determined traffic data, it is possible to comprehensively and accurately reflect the feature information of the data packets contained in the sessions corresponding to each session identifier contained in the network data.

[0099] Based on the above embodiment, in the feature extraction method provided in the embodiment of the present application, before extracting the context semantic feature of the kth data, the following steps may be further included: Figure 2 The process shown, Figure 2 The flowchart of obtaining the kth data provided in the embodiment of the present application is as follows: Figure 2 As shown, the process may include the following steps:

[0100] Step 201: Obtain data associated with the mth session identifier from the parsing result.

[0101] In one embodiment, the data associated with the mth session identifier may include at least a portion of the data associated with the mth session identifier in the parsing result.

[0102] In one embodiment, a target data volume, sampling frequency, sampling interval, or data selection period can be determined, and then based on the target data volume, sampling frequency, sampling interval, or data selection period, data can be selected from the data packets associated with the mth session identifier in the parsing results, and the above selection results can be determined as the data associated with the mth session identifier.

[0103] Step 202: Obtain kth initial data from the data associated with the mth session identifier through a sliding window.

[0104] The kth initial data includes data obtained for the kth time from data associated with the mth session identifier.

[0105] In one implementation, the sliding window may be a sliding window of a semantic extraction model.

[0106] In one embodiment, the length of the sliding window can be predetermined; exemplarily, the length of the sliding window can be adjusted or determined according to at least one of the session identifier, the device attributes associated with the session corresponding to the session identifier, the service type of the data packet associated with the session identifier, and the duration of the session associated with the session identifier; exemplarily, the device attributes may include the device type, such as a terminal device, a network device, or an intermediate device; exemplarily, the service type may include a text data processing service, a video data processing service, etc.

[0107] In one embodiment, the length of the sliding window may also be adjusted or changed according to at least one of the type, structure, and computation time of the semantic extraction model.

[0108] In one embodiment, the kth initial data and the k+1th initial data may be partially repeated.

[0109] In one embodiment, the kth initial data and the (k+1)th initial data may not contain the same data.

[0110] In one embodiment, a sliding window may be controlled based on the data processing speed of the semantic extraction model to sequentially obtain the kth data, the k+1th data, and the k+2th data from the data associated with the mth session identifier; illustratively, the above-mentioned data processing speed may include the reciprocal of the length of time between the moment when the input data is obtained from the semantic extraction model and the moment when the semantic extraction result is obtained.

[0111] Step 203: Associate the mth session identifier with the kth initial data to obtain the kth data.

[0112] In one embodiment, the mth session identifier can be added to the kth initial data, and the kth initial data after the mth session identifier is added can be determined as the kth data; illustratively, the mth session identifier can be associated with the header of the kth initial data, and the kth initial data with the header associated with the mth session identifier can be determined as the kth data.

[0113] From the above, it can be seen that the feature extraction method provided in the embodiment of the present application, after obtaining the data associated with the mth session identifier from the parsing result, can obtain the kth initial data from the data associated with the mth session identifier through a sliding window, so that the data volume and acquisition time of the kth initial data can match the actual data processing speed, thereby improving the semantic extraction efficiency; and, by associating the mth session identifier with the kth initial data to obtain the kth data, the kth data contains information of the mth session identifier. In this way, through the mth session identifier, the extraction direction of the session feature dimension can be guided, thereby improving the efficiency of session feature extraction and fusion.

[0114] Based on the aforementioned embodiment, in the feature extraction method provided in the embodiment of the present application, determining the feature extraction result of the traffic data based on the kth feature extraction result associated with the mth session identifier can be achieved by the following steps:

[0115] Obtain a weight set; based on the weight set, process the feature extraction results associated with the first session identifier to the feature extraction results associated with the Mth session identifier to obtain a feature extraction result of the traffic data.

[0116] Wherein, M includes the number of identifiers in the session identifier.

[0117] In one embodiment, the number of weights in the weight set may be M.

[0118] In one embodiment, the values ​​of each weight in the weight set may be different; illustratively, the values ​​of the weights in the weight set may be the same; illustratively, the values ​​of each weight in the weight set may be adjusted or determined based on at least one of the requirements for feature extraction, the value range of the data in the feature extraction results associated with each session identifier, and the business type associated with the traffic data.

[0119] In one embodiment, K feature extraction results associated with the mth session identifier can be integrated to obtain a feature extraction result associated with the mth session identifier. In this way, the feature extraction result associated with the mth session identifier can be obtained by the above method; correspondingly, the feature extraction results associated with the first session identifier to the feature extraction results associated with the Mth session identifier can be obtained respectively by the above method.

[0120] In one embodiment, the data dimensions of the feature extraction results associated with the first session identifier to the feature extraction results associated with the Mth session identifier may be the same, for example, they may all be 1*N matrices, where N may be an integer greater than 1.

[0121] In one embodiment, the feature extraction result can be obtained by:

[0122] Based on the first weight to the Mth weight in the weight set, a weighted sum is performed on the feature extraction results associated with the first session identifier and the feature extraction results associated with the Mth session identifier, respectively, to obtain a feature extraction result. Exemplarily, when the weights in the weight set are the same, the feature extraction results associated with the first session identifier and the feature extraction results associated with the Mth session identifier can be directly summed, and the summed result can be determined as the feature extraction result.

[0123] When the feature extraction result of the mth session is a feature vector, the above operation can obtain a feature vector representation of the traffic data. Moreover, when the feature extraction results associated with the first session identifier and the feature extraction results associated with the Mth session identifier have the same dimension, such as 1*N, the dimension of the feature vector of the traffic data obtained by the above method can also be 1*N. In this way, since the feature vector of the traffic data is regular, the efficiency of processing the feature extraction results of the traffic data can be greatly improved in the subsequent processing of the feature extraction results of the traffic data, such as outputting the feature extraction results or sending the feature extraction results to a downstream traffic data processing device. The downstream traffic data processing device may include a device that subsequently processes the traffic packets contained in the traffic data.

[0124] Exemplarily, the above-mentioned feature extraction result can be a session vector representation at the data packet level. Therefore, the above-mentioned feature extraction result can not only comprehensively reflect the traffic characteristics of the session corresponding to the session identifier, but also effectively aggregate the feature information in at least part of the data packets in the session corresponding to the session identifier, thereby reducing the redundancy of the feature vector in the feature extraction result and improving the comprehensiveness of the feature extraction result.

[0125] From the above, it can be seen that the feature extraction method provided in the embodiment of the present application, after obtaining the weight set, can process the feature extraction results associated with each session identifier based on the weight set, thereby obtaining the feature extraction results of the traffic data. In this way, by adjusting the value of the weight in the weight combination, targeted screening of the data in the feature extraction results associated with each session identifier can be achieved; and through the above processing, the feature extraction results can comprehensively and holistically display the feature information of the session granularity contained in the traffic data, thereby further improving the comprehensiveness of the feature extraction results of the traffic data.

[0126] Based on the above embodiment, in the feature extraction method provided in the embodiment of the present application, analyzing the data packets in the traffic data to obtain the session identifier of the data packets can be achieved by the following methods:

[0127] At least address information and protocol information are obtained from the data packet, and the address information and protocol information are analyzed to obtain a session identifier of the data packet.

[0128] In one embodiment, the address information may include a destination address of the data packet; exemplarily, the destination address may include an address of a target device for receiving the data packet, such as a Media Access Control (MAC) address, an Internet Protocol (IP) address, and a Domain Name System (DNS) of the target device; exemplarily, the destination address may also include a port address of the target device for receiving the data packet.

[0129] In one embodiment, the address information may also include the source address of the data packet; exemplarily, the above-mentioned source address may include the address of the source device that sends the data packet, such as the MAC address, IP address and DNS of the source device; exemplarily, the source address may also include the port address of the source device that sends the data packet.

[0130] In one embodiment, the protocol information may include a standard data transmission protocol based on which data is transmitted between the source device and the target device, such as TCP, User Datagram Protocol (UDP), and the like.

[0131] In one implementation, the address and port number of the source device, the address and port number of the destination device, and the protocol information contained in the data packet may be determined as a five-tuple of the data packet.

[0132] In one embodiment, the session identifier of the data packet may be determined by:

[0133] The address information of each data packet is matched and parsed according to the address type, and the protocol information of each data packet is matched and parsed according to the protocol type. Numbers are set for unmatched address types and protocol types respectively, and then the above numbers are determined as session identifiers of the data packets.

[0134] In one embodiment, the session identifier may be embodied in the form of numbers, characters, character strings, or a combination of numbers and characters, which is not limited in this embodiment of the present application.

[0135] From the above, it can be seen that in the feature extraction method provided in the embodiment of the present application, after obtaining the address information and protocol information from the data packet, the address information and protocol information can be analyzed to obtain the session identifier of the data packet.

[0136] Since the address information contained in the data packet can characterize the transmission direction and transmission path of the data packet, and the protocol information can characterize the transmission method of the data packet in the network, the address information and protocol information can completely characterize the session transmission status of the data packet in the network, so that the session identifier determined by the above method can accurately and uniquely represent the transmission status of the data packet in the network, as well as the source and transmission target of the data packet.

[0137] Based on the foregoing embodiment, in the feature extraction method provided in the embodiment of the present application, traffic data is stored in a Pcap file.

[0138] In actual applications, the device address, such as the IP address, can be set in advance, and then the traffic data associated with the above IP address can be captured through a packet capture tool such as tcpdump, and the traffic data can be saved in a file ending with *.pcap, so that the above-mentioned Pcap file can be obtained; illustratively, each Pcap file can include multiple packets. If the multiple packets are simply split, the session features will be discrete. In the embodiment of the present application, the session identifier of each packet is first extracted, and the data packets in the traffic data are parsed based on the session identifier, so that the parsing result can contain complete, continuous and comprehensive session features.

[0139] Correspondingly, the data packets in the traffic data are parsed based on the session identifier to obtain the parsing results, which can be obtained through Figure 3 The process shown is implemented as follows, Figure 3 A schematic diagram of a process for obtaining analysis results provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, the process may include the following steps:

[0140] Step 301: Classify and sort the data packets in the Pcap file based on the session identifier to obtain a classification and sorting result.

[0141] In one embodiment, the classification and sorting results can be obtained by:

[0142] Classify the data packets in the Pcap file based on the session identifier to obtain the classification result, then obtain the time information carried by each data packet in the classification result, and then sort the data packets in the classification result according to the above time information to obtain the classification sorting result; illustratively, the above time information may include the timestamp of the data packet.

[0143] Step 302: Obtain structural information of the data packets in the classification and sorting results.

[0144] In one embodiment, the structural information may include information such as the size of the data packet, the offset position of each field, the type of data carried by each field, and the meaning of different values.

[0145] In one embodiment, the data transmission protocols based on which the data packets are transmitted in different classification and sorting results may be different. Since different data transmission protocols correspond to different data encapsulation methods, the structural information of the data packets in different classification and sorting results may be different.

[0146] Step 303: Based on the structural information, perform field parsing on the data packets in the classification and sorting results to obtain parsing results.

[0147] In one embodiment, the parsing result can be obtained by:

[0148] Based on the mth structural information, each field of the data packet in the mth classification result is parsed to obtain the mth parsing result, and then the first parsing result to the Mth parsing result are integrated to obtain the parsing result; wherein the mth structural information may include the structure of the data packet in the mth classification result.

[0149] Based on the mth structural information, at least two specified fields of the data packet in the mth classification result are parsed to obtain the mth parsing result, and then the first parsing result to the Mth parsing result are integrated to obtain the parsing result; exemplarily, the at least two specified fields can be adjusted according to the feature extraction requirements of the network traffic data, the device type, business type, and time period corresponding to the network traffic data.

[0150] From the above, it can be seen that the feature extraction method provided in the embodiment of the present application, after classifying and sorting the data packets in the Pcap file based on the session identifier, obtains the classification and sorting results, which can clearly and time-correlatedly display the transmission status of the data packets in the entire Pcap file at the session level corresponding to the session identifier; and obtains the structural information of the data packets in the classification and sorting results, and performs field parsing on the data packets in the classification and sorting results based on the structural information, so that the data in the parsing results can be more regular, and the probability of data being incorrectly parsed and partially intercepted and cut can be reduced, thereby improving the consistency between the parsing results and the network data.

[0151] Based on the above embodiments, in the feature extraction method provided in the embodiments of the present application, field parsing of the data packets in the classification and sorting results is performed based on the structural information to obtain the parsing results, which can be achieved in the following manner:

[0152] Based on the structural information, the first part of the data and the second part of the data are determined from the nth data packet in the classification and sorting results; the fields in the first part of the data are cut and parsed based on the target characters to obtain the first parsing result of the nth data packet; the second part of the data is converted and parsed to obtain the second parsing result of the nth data packet; based on the first parsing result of the nth data packet and the second parsing result of the nth data packet, the parsing result of the nth data packet is determined.

[0153] Among them, the degree of correlation between the data in the first part of the data is less than or equal to the correlation threshold; the degree of correlation between the data in the second part of the data is greater than the correlation threshold; n is an integer greater than or equal to 1; the nth data packet is any data packet in the classification and sorting results.

[0154] In one embodiment, the correlation threshold may be determined based on the degree of correlation between the data filled in each field in the nth data packet; illustratively, the correlation threshold may be used to indicate whether the data filled in each field in the nth data packet can be segmented according to characters.

[0155] In one embodiment, the data in the classification and sorting results may be expressed in hexadecimal format.

[0156] In one embodiment, the first portion of data may include data that can be segmented into numbers or characters one by one, and accordingly, the second portion of data may include data that cannot be directly segmented into numbers or characters one by one, for example, directly segmenting the second portion of data into single numbers or characters will result in semantically missing or confused data.

[0157] In one embodiment, the target characters may include space characters.

[0158] In one embodiment, the first portion of data may be segmented character by character according to the target character, and the character segmentation result may be determined as the first parsing result of the nth data packet.

[0159] In one embodiment, the second parsing result of the nth data packet may be different from the first parsing result of the nth data packet in at least one of a representation format, a data volume, and a data structure.

[0160] In one embodiment, the first parsing result and the second parsing result may be spliced ​​based on the structure information, and the spliced ​​result may be determined as the parsing result of the nth data packet.

[0161] In one embodiment, the parsing results of each data packet corresponding to the mth session identifier can be determined as the parsing result of the mth session identifier; illustratively, the parsing result of the mth session identifier can include a concatenation result of the parsing results of each data packet corresponding to the mth session identifier.

[0162] In one implementation, the parsing results corresponding to the first session identifier and the parsing results corresponding to the Mth session identifier may be concatenated to obtain a parsing result.

[0163] From the above, it can be seen that in the feature extraction method provided in the embodiment of the present application, the first part of the data and the second part of the data of the nth data packet are determined from the sorting results based on the structural information, and the degree of correlation between the data in the first part of the data is different, thereby realizing the accurate division of the data in any data packet in the traffic data based on the structural information; and, through different analysis and processing of different parts of the nth data packet, targeted analysis of different parts of the data in the nth data packet can be achieved, thereby improving the correctness of the analysis of the nth data packet.

[0164] Based on the above embodiment, in the feature extraction method provided in the embodiment of the present application, performing a second conversion and analysis on the second portion of data to obtain a second analysis result of the nth data packet can be achieved by the following method:

[0165] Performing character conversion on the second portion of data to obtain a conversion result; and performing word segmentation parsing on the second portion of data based on the conversion result to obtain a second parsing result of the nth data packet.

[0166] In one embodiment, the second portion of data may include data that cannot be simply segmented by characters, such as a Uniform Resource Locator (URL) and an IP address in the payload of a data packet. If these data are simply segmented by characters, semantic fragmentation will result.

[0167] In one embodiment, the numbers included in the second part of the data can be mapped and converted according to a preset mapping relationship between characters and numbers to obtain a conversion result. For example, when the second part of the data is 62 61 696475 2e 63 6f 6d, the conversion result obtained by character conversion of the above data is baidu.com.

[0168] In one embodiment, the second part of the data can be segmented according to the meaning represented by the conversion result to obtain the second parsing result of the nth data packet. For example, when the above conversion result is baidu.com, the hexadecimal digits in the second part of the data can be merged according to the above conversion result to obtain the second parsing result of the nth data packet represented as 62616964752e636f6d.

[0169] In the network data packet segmentation methods provided by related technologies, all data is uniformly segmented based on spaces. For example, if the port number is 50 in hexadecimal, then using the method of segmenting the hexadecimal content based on spaces in related technologies will render the port number invalid. However, the method provided by the embodiments of the present application can achieve accurate and effective segmentation of the unsplittable data portion.

[0170] From the above, it can be seen that in the feature extraction method provided in the embodiment of the present application, the semantic features of the conversion result obtained by character conversion of the second part of the data are more intuitive, so that the second parsing result obtained by word segmentation and parsing of the second part of the data based on the conversion result can be more consistent with the semantic information carried by the second part of the data itself, thereby improving the accuracy of the second parsing result.

[0171] Figure 4 Another flow chart of the feature extraction method provided in the embodiment of the present application is as follows: Figure 4 As shown, the process may include the following steps:

[0172] Step 401: Collect traffic data and save it as a Pcap file.

[0173] In one embodiment, the flow data may be collected by using a packet capture tool, and the collected flow data may be saved as a Pcap file.

[0174] Step 402: segment the Pcap file according to the session granularity to obtain a session segmentation result.

[0175] In one embodiment, a quintuple, i.e., the address information and protocol information in the aforementioned embodiment, can be extracted from the data packets contained in the Pcap file, and then the session identifier is determined based on the address information and protocol information. The data packets in the Pcap are then segmented or classified based on the session identifier, and the segmentation or classification results are sorted according to the time information in the data packets, and the sorting result is determined as the session segmentation result, wherein the session segmentation result can be the classification sorting result in the aforementioned embodiment.

[0176] Step 403: Preprocess the session segmentation result to obtain a preprocessing result.

[0177] In one embodiment, the pre-processing may include removing invalid characters in the session segmentation; illustratively, the invalid characters may include disabled characters, etc.

[0178] In one embodiment, preprocessing may also include determining a first portion of data and a second portion of data from any data packet, and performing segmentation and parsing on the fields in the first portion of data based on space characters to obtain a first parsing result of any data packet. The second portion of data may also be converted and parsed, that is, the second portion of data may be character converted to obtain a conversion result, and then data segmentation and parsing may be performed on the second portion of data based on the conversion result to obtain a second parsing result of any data packet.

[0179] In one embodiment, the preprocessing result may include a splicing result obtained by splicing the first parsing result and the second parsing result based on the structural information of the data packet.

[0180] Step 404: Merge the data in all data packets of each session in the pre-processing result to obtain a traffic content collection of each session.

[0181] In one embodiment, the traffic content collection of each session can be obtained by:

[0182] The space characters contained in the data in each data packet of each session in the preprocessing result are removed, and then the data in each data packet of each session in the preprocessing result after the space characters are removed are spliced, and then the hexadecimal digital sequence result obtained by splicing is determined as the traffic content collection of each session.

[0183] Step 405: Extract semantic feature vectors of all data packets of each session from the traffic content collection of each session.

[0184] In one embodiment, a semantic feature vector of each data packet in the traffic content collection of each session can be extracted using a semantic extraction model such as CBOW; illustratively, the semantic feature vector may include feature extraction results of each data packet associated with the mth session identifier represented in vector form.

[0185] Step 406: Extract the vector feature representation of each session, and determine the feature vector of the Pcap file based on the vector feature representation of each session.

[0186] In one embodiment, the vector feature representations of the data packets in each session may be superimposed to obtain the vector feature representation of each session, ie, the feature extraction result associated with the mth session identifier in the aforementioned embodiment.

[0187] In one embodiment, a weighted average process may be performed on the feature extraction results associated with the first session identifier and the feature extraction results associated with the Mth session identifier based on the weight set, and the weighted average result may be determined as a feature vector of the Pcap file.

[0188] Step 407: Send the feature vector of the Pcap file to the downstream task of the traffic data.

[0189] In one embodiment, the downstream tasks of the traffic data may include tasks performed by other devices for processing data packets in the traffic data; illustratively, other devices for processing data packets in the traffic data may include terminal devices or server devices such as IOT devices.

[0190] In one embodiment, the execution conditions and / or execution strategies of downstream tasks may be adjusted based on the feature vectors of the Pcap file, thereby improving the stability and efficiency of network data transmission.

[0191] From the above, it can be seen that the feature extraction method provided in the embodiment of the present application, by analyzing the data packets in the traffic data, obtains the session identifier of the data packet, which can provide an accurate parsing basis for the subsequent parsing of the data packets in the network data; and, based on the session identifier, the data packets in the traffic data are parsed so that the data in the parsing result can be associated with the session identifier, that is, the data in the parsing result can fully include the data packets contained in the session corresponding to the session identifier, thereby improving the integrity of the data packets in the parsing result at the session granularity; at the same time, feature extraction is performed on the data in the parsing result, and the feature extraction result of the traffic data obtained can comprehensively, time-relatedly, and accurately display the feature change status of the data packets of the session corresponding to the session identifier.

[0192] Based on the above embodiments, the present application also provides a determination method. Figure 5A flow chart of the determination method provided in the embodiment of the present application is shown as follows: Figure 5 As shown, the process may include the following steps:

[0193] Step 501: Analyze the data packets in the traffic data to obtain the session identifiers of the data packets.

[0194] Step 502: Parse the data packets in the traffic data based on the session identifier to obtain a parsing result.

[0195] Step 503: Perform feature extraction on the data in the analysis result to obtain feature extraction results of the traffic data.

[0196] Step 504: Determine the security status of the traffic data based on the feature extraction result.

[0197] In one embodiment, the security status may indicate whether the traffic data contains potential threat data, whether it contains threat data, etc., and may also include whether at least one session in the traffic data is in a secure state.

[0198] In one embodiment, based on the feature extraction result, a session security state associated with the session identifier of the traffic data may be determined.

[0199] The determination method provided in the embodiment of the present application analyzes the data packets in the traffic data to obtain the session identifier of the data packet, which can provide an accurate session identifier basis for the subsequent parsing of the data packets in the network data; and, based on the session identifier, the data packets in the traffic data are parsed so that the data in the parsing result can be associated with the session identifier, that is, the data in the parsing result can fully include the data packets included in the session corresponding to the session identifier, thereby improving the integrity of the data packets in the parsing result at the session granularity; at the same time, feature extraction is performed on the data in the parsing result, and the feature extraction result of the traffic data obtained can comprehensively, time-relatedly, and accurately display the feature change status of the data packets of the session corresponding to the session identifier; on this basis, the security status of the traffic data determined based on the feature extraction result can comprehensively and accurately reflect the actual security status of the traffic data.

[0200] Based on the above embodiments, the present application also provides a training method. Figure 6 A flow chart of the training method provided in the embodiment of the present application is shown in FIG. Figure 6 As shown, the process may include the following steps:

[0201] Step 601: Analyze the data packets in the traffic data to obtain the session identifiers of the data packets.

[0202] Step 602: Parse the data packets in the traffic data based on the session identifier to obtain a parsing result.

[0203] Step 603: Perform feature extraction on the data in the analysis result to obtain feature extraction results of the traffic data.

[0204] Step 604: Train the initial feature extraction model based on the feature extraction result to obtain a feature extraction model.

[0205] In one embodiment, the traffic data can be input into the initial feature extraction model to obtain the extraction results, and the feature extraction results can be used as label information. Then, according to the degree of matching between the feature extraction results and the extraction results, the parameters of the initial feature extraction model can be adjusted to achieve the training of the initial feature extraction model.

[0206] In one embodiment, a loss function may be designed, and when the loss function determines that the difference between the feature extraction result and the extraction result is less than or equal to a difference threshold, the training of the initial feature extraction model is stopped, thereby obtaining a feature extraction model.

[0207] In one embodiment, the feature extraction model can be applied to the feature extraction at the session level of traffic data, and can also be applied to the state determination of traffic data, which is not limited in this embodiment of the present application.

[0208] The training method provided in the embodiment of the present application analyzes the data packets in the traffic data to obtain the session identifier of the data packets, which can provide an accurate session identification basis for the subsequent parsing of the data packets in the network data; and, based on the session identifier, the data packets in the traffic data are parsed so that the data in the parsing result can be associated with the session identifier, that is, the data in the parsing result can fully include the data packets contained in the session corresponding to the session identifier, thereby improving the integrity of the data packets in the parsing result at the session granularity; at the same time, feature extraction is performed on the data in the parsing result, and the feature extraction result of the traffic data obtained can comprehensively, time-relatedly, and accurately display the feature change status of the data packets of the session corresponding to the session identifier; on this basis, the feature extraction model obtained by training the initial feature extraction model based on the feature extraction result can comprehensively and accurately track the feature data at the session level in the traffic data.

[0209] Based on the above embodiments, the present application also provides a feature extraction device. Figure 7 A structural diagram of a feature extraction device provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, the apparatus may include a processing module 701 and a feature extraction module 702; wherein:

[0210] The processing module 701 is used to analyze the data packets in the traffic data to obtain the session identifier of the data packet; parse the data packets in the traffic data based on the session identifier to obtain the parsing result;

[0211] The feature extraction module 702 is used to extract features from the data in the analysis results to obtain feature extraction results of the traffic data.

[0212] In some embodiments, the feature extraction module 702 is configured to extract contextual semantic features from the kth data to obtain a kth feature extraction result associated with the mth session identifier; wherein the kth data includes at least a portion of the data associated with the mth session identifier in the parsing result; and m and k are both integers greater than or equal to 1.

[0213] The processing module 701 is configured to determine a feature extraction result of the traffic data based on the kth feature extraction result associated with the mth session identifier.

[0214] In some embodiments, the processing module 701 is used to obtain data associated with the mth session identifier from the parsing results; obtain kth initial data from the data associated with the mth session identifier through a sliding window; associate the mth session identifier with the kth initial data to obtain kth data; wherein the kth initial data includes data obtained for the kth time from the data associated with the mth session identifier.

[0215] In some embodiments, the processing module 701 is used to obtain a weight set; based on the weight set, the feature extraction results associated with the first session identifier to the feature extraction results associated with the Mth session identifier are processed to obtain feature extraction results of the traffic data; wherein M includes the number of identifiers in the session identifier.

[0216] In some embodiments, the processing module 701 is configured to obtain at least address information and protocol information from a data packet; and analyze the address information and protocol information to obtain a session identifier of the data packet.

[0217] In some embodiments, the traffic data is stored in a Pcap file;

[0218] The processing module 701 is used to classify and sort the data packets in the Pcap file based on the session identifier to obtain the classification and sorting results; obtain the structural information of the data packets in the classification and sorting results; and perform field analysis on the data packets in the classification and sorting results based on the structural information to obtain the analysis results.

[0219] In some embodiments, the processing module 701 is configured to determine, based on the structure information, a first portion of data and a second portion of data from an nth data packet in the classification and sorting result; wherein the degree of correlation between the data in the first portion of data is less than or equal to a correlation threshold; the degree of correlation between the data in the second portion of data is greater than the correlation threshold; n is an integer greater than or equal to 1; and the nth data packet is any data packet in the classification and sorting result;

[0220] The processing module 701 is used to cut and parse the fields in the first part of the data based on the target characters to obtain a first parsing result of the nth data packet; convert and parse the second part of the data to obtain a second parsing result of the nth data packet; and determine the parsing result of the nth data packet based on the first parsing result of the nth data packet and the second parsing result of the nth data packet.

[0221] In some embodiments, the processing module 701 is configured to perform character conversion on the second portion of data to obtain a conversion result; and perform word segmentation analysis on the second portion of data based on the conversion result to obtain a second analysis result of the nth data packet.

[0222] Based on the above embodiments, the present application also provides an electronic device, Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 8 As shown, the electronic device may include a processor 801 and a memory 802, wherein the memory 802 stores a computer program, and when the computer program is executed by the processor 801, it can implement any of the feature extraction methods, determination methods and training methods described above.

[0223] The above-mentioned processor can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

[0224] The memory may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), flash memory, a hard disk drive (HDD) or a solid state drive (SSD); or a combination of the above types of memory, and provides instructions and data to the processor.

[0225] The above-mentioned processing module and feature extraction module can also be implemented by a processor of an electronic device.

[0226] Based on the foregoing embodiments, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor of an electronic device, it can implement the feature extraction method, determination method and training method provided in any of the previous embodiments.

[0227] The above description of the various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced with each other and will not be repeated herein for the sake of brevity.

[0228] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0229] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0230] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0231] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface storage, an optical disc, or a compact disc read-only memory (CD-ROM); it can also be various electronic devices that include one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0232] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0233] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0234] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0235] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0236] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0237] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0238] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A feature extraction method, characterized in that: The method comprises: Analyzing data packets in the traffic data to obtain session identifiers of the data packets; Parsing the data packets in the traffic data based on the session identifier to obtain a parsing result; Performing contextual semantic feature extraction on the kth data to obtain a kth feature extraction result associated with the mth session identifier; wherein the kth data includes at least a portion of the data associated with the mth session identifier in the parsing result; and m and k are both integers greater than or equal to 1; determining a feature extraction result of the traffic data based on a kth feature extraction result associated with the mth session identifier; Before extracting contextual semantic features from the kth data, the method further includes: Acquire data associated with the mth session identifier from the parsing result; Obtaining kth initial data from the data associated with the mth session identifier through a sliding window; wherein the kth initial data includes data obtained for the kth time from the data associated with the mth session identifier; The mth session identifier is associated with the kth initial data to obtain the kth data.

2. The method according to claim 1, characterized in that The determining the feature extraction result of the traffic data based on the kth feature extraction result associated with the mth session identifier includes: Get the weight set; Based on the weight set, feature extraction results associated with the first session identifier to the feature extraction results associated with the Mth session identifier are processed to obtain feature extraction results of the traffic data; wherein M includes the number of identifiers in the session identifier.

3. The method according to claim 1, characterized in that The analyzing the data packets in the traffic data to obtain the session identifiers of the data packets includes: Obtaining at least address information and protocol information from the data packet; The address information and the protocol information are analyzed to obtain a session identifier of the data packet.

4. A determination method, characterized in that: The method comprises: Analyzing data packets in the traffic data to obtain session identifiers of the data packets; Parsing the data packets in the traffic data based on the session identifier to obtain a parsing result; Performing contextual semantic feature extraction on the kth data to obtain a kth feature extraction result associated with the mth session identifier; wherein the kth data includes at least a portion of the data associated with the mth session identifier in the parsing result; and m and k are both integers greater than or equal to 1; determining a feature extraction result of the traffic data based on a kth feature extraction result associated with the mth session identifier; Determining a security status of the traffic data based on the feature extraction result; Before extracting contextual semantic features from the kth data, the method further includes: Acquire data associated with the mth session identifier from the parsing result; Obtaining kth initial data from the data associated with the mth session identifier through a sliding window; wherein the kth initial data includes data obtained for the kth time from the data associated with the mth session identifier; The mth session identifier is associated with the kth initial data to obtain the kth data.

5. A training method, characterized in that: The method comprises: Analyzing data packets in the traffic data to obtain session identifiers of the data packets; Parsing the data packets in the traffic data based on the session identifier to obtain a parsing result; Performing contextual semantic feature extraction on the kth data to obtain a kth feature extraction result associated with the mth session identifier; wherein the kth data includes at least a portion of the data associated with the mth session identifier in the parsing result; and m and k are both integers greater than or equal to 1; determining a feature extraction result of the traffic data based on a kth feature extraction result associated with the mth session identifier; Training an initial feature extraction model based on the feature extraction result to obtain a feature extraction model; Before extracting contextual semantic features from the kth data, the method further includes: Acquire data associated with the mth session identifier from the parsing result; Obtaining kth initial data from the data associated with the mth session identifier through a sliding window; wherein the kth initial data includes data obtained for the kth time from the data associated with the mth session identifier; The mth session identifier is associated with the kth initial data to obtain the kth data.

6. A feature extraction device, characterized in that: The device comprises: A processing module, configured to analyze data packets in the flow data to obtain session identifiers of the data packets; and parse the data packets in the flow data based on the session identifiers to obtain parsing results; a feature extraction module configured to perform contextual semantic feature extraction on the kth data to obtain a kth feature extraction result associated with the mth session identifier; wherein the kth data includes at least a portion of the data associated with the mth session identifier in the parsing result; and m and k are both integers greater than or equal to 1; The processing module is further configured to determine a feature extraction result of the traffic data based on a kth feature extraction result associated with the mth session identifier; The processing module is configured to obtain data associated with the mth session identifier from the parsing result; obtain kth initial data from the data associated with the mth session identifier using a sliding window; wherein the kth initial data includes data obtained for the kth time from the data associated with the mth session identifier; and associate the mth session identifier with the kth initial data to obtain the kth data.

7. An electronic device, characterized in that: The device includes a processor and a memory, wherein a computer program is stored in the memory. When the computer program is executed by the processor, it can implement the feature extraction method according to any one of claims 1 to 3, the determination method according to claim 4, and the training method according to claim 5.

8. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which, when executed by a processor of an electronic device, can implement the feature extraction method according to any one of claims 1 to 3, the determination method according to claim 4, and the training method according to claim 5.

Images