A flow spectrum mapping method and device based on a pre-trained model

Abstract

The application provides a flow spectrum mapping method and device based on a pre-training model. The method comprises the following steps: obtaining multiple data packets of the same five-tuple, converting an initial string of each data packet into a token string comprising multiple tokens based on a Bi-gram model, mapping each token into a corresponding character based on a preset mapping dictionary to obtain a mapping string; inputting the mapping string into a pre-training model, performing dimensionality increasing expression on each character in the mapping string to obtain a flow spectrum mapping matrix; inputting the flow spectrum mapping matrix corresponding to each data packet into multiple preset classification models simultaneously to obtain classification results; combining each classification model with the pre-training model into a splicing model, calculating a loss function through the classification result corresponding to each classification model, updating the model parameters of each splicing model through a back propagation algorithm, and obtaining a pre-training model that has completed training. The method can effectively improve the training efficiency.

Description

Technical Field

[0001] This invention relates to the field of streaming data analysis technology, and in particular to a streaming spectrum mapping method and apparatus based on a pre-trained model. Background Technology

[0002] With the significant increase in digitalization in daily life, data transmission via the network has become commonplace. To protect information privacy and security, technologies such as VPNs, TLS 1.3, and Tor have been proposed for traffic encryption / anonymity. However, while these methods protect user privacy, hacker groups also exploit them to conceal malicious activities, posing a significant challenge to network supervision. Network flow is the carrier of network information; all network behaviors can be mapped to network flows. Therefore, it is necessary to analyze network flows, identify network behavior recognition methods based on network flows, promptly detect malicious traffic and behaviors, provide effective support for cyberspace management, and ensure network security.

[0003] Behavioral analysis of streaming data is currently mainly divided into two types: plaintext payload and ciphertext payload. Plaintext payload analysis is difficult to handle encrypted traffic, while ciphertext payload analysis often adopts machine learning schemes based on statistical features or end-to-end deep learning schemes.

[0004] In processing streaming data analysis tasks, existing technologies typically employ end-to-end deep learning solutions. These solutions usually require deep learning models, which include encoding and classification components. However, existing technologies often rely on large amounts of data and labeled data to train the entire model, resulting in excessive dependence on labeled data during training and low training efficiency. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a streaming spectrum mapping method based on a pre-trained model to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present invention provides a stream spectrum mapping method based on a pre-trained model, the method comprising the following steps:

[0007] Multiple data packets with the same quintuple are obtained. The initial string of each data packet is converted into a token string containing multiple tokens based on the Bi-gram model. Each token is mapped to the corresponding character based on a preset mapping dictionary to obtain the mapping string.

[0008] The mapping string is input into the pre-trained model, and each character in the mapping string is expressed in higher dimensions to obtain the flow spectrum mapping matrix;

[0009] The stream spectrum mapping matrix corresponding to each data packet is simultaneously input into multiple preset classification models to obtain classification results;

[0010] Each classification model is combined with a pre-trained model to form a concatenated model. The loss function is calculated using the classification results of each classification model. The model parameters of each concatenated model are updated using the backpropagation algorithm to obtain a pre-trained model that has been trained.

[0011] Using the above scheme, the pre-trained model can represent each character in the mapped string in higher dimensions, perform stream spectrum mapping, and obtain a stream spectrum mapping matrix, which encodes the string. This allows for pre-training of the encoding part of the streaming data analysis task. When a classification task is required, technicians only need to concatenate the classifier for the corresponding classification task into the pre-trained model. Since the pre-trained model has already completed the training of the encoding, only a small amount of labeled data is needed to train the concatenated model as a whole after concatenating the classifier. Therefore, this method can effectively improve training efficiency.

[0012] In some embodiments of the present invention, before the step of converting the initial string of each data packet into a token string including multiple tokens based on the Bi-gram model, the method further includes converting the corresponding binary data of each data packet into hexadecimal data, and using the resulting hexadecimal data as the initial string.

[0013] In some embodiments of the present invention, in the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into multiple preset classification models, the multiple classification models include a hidden state prediction model, which outputs the predicted hidden state based on the input stream spectrum mapping matrix.

[0014] In some embodiments of the present invention, in the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a hidden state prediction model, then the loss function is calculated based on the predicted hidden state output by the hidden state prediction model and the hidden state label of the data packet.

[0015] In some embodiments of the present invention, the steps preceding the step of calculating the loss function based on the predicted hidden state output by the hidden state prediction model and the hidden state label of the data packet further include:

[0016] Obtain the size of each data packet and the time interval between each data packet and the previous data packet in the plurality of data packets;

[0017] Calculate the logarithm of the interval time;

[0018] Based on the size of each data packet and the logarithm of the interval time, construct two-dimensional coordinates for each data packet;

[0019] The two-dimensional coordinates corresponding to the multiple data packets are clustered using a clustering algorithm to obtain the hidden state label of each data packet.

[0020] In some embodiments of the present invention, if the plurality of classification models include a message unit prediction model, then the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into the preset plurality of classification models includes:

[0021] Replace any column in the stream spectrum mapping matrix, and input the replaced stream spectrum mapping matrix into the message unit prediction model;

[0022] The message unit prediction model identifies the replacement results for columns based on the input stream spectrum mapping matrix.

[0023] In some embodiments of the present invention, in the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a message unit prediction model, then the loss function is calculated based on the replacement result identified by the message unit prediction model and the actual replacement result.

[0024] In some embodiments of the present invention, if the plurality of classification models include a load prediction model, then the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into the preset plurality of classification models includes:

[0025] Obtain the columns belonging to the header and load portions of the stream spectrum mapping matrix;

[0026] Replace all columns belonging to the header or load portion in the flow spectrum mapping matrix, and input the replaced flow spectrum mapping matrix into the load prediction model;

[0027] The load prediction model identifies the replacement result of the header or load portion based on the input flow spectrum mapping matrix.

[0028] In some embodiments of the present invention, in the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a load prediction model, then the loss function is calculated based on the replacement result of the header or load portion identified by the load prediction model and the actual replacement result of the header or load portion.

[0029] Another aspect of the present invention provides a streaming spectrum mapping device based on a pre-trained model. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0030] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0031] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0032] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0033] Figure 1 This is a schematic diagram of one embodiment of the pre-trained model-based flow spectrum mapping method of the present invention;

[0034] Figure 2 This is a schematic diagram showing the connection of the various models in this invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0036] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0037] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0038] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0039] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0040] To solve the above problems, such as Figure 1 As shown, this invention proposes a stream spectrum mapping method based on a pre-trained model, the steps of which include:

[0041] Step S100: Obtain multiple data packets with the same quintuple; convert the initial string of each data packet into a token string containing multiple tokens based on the Bi-gram model; map each token to the corresponding character based on a preset mapping dictionary to obtain the mapping string.

[0042] In the specific implementation process, the traffic is first divided into five-tuple data, namely source IP, destination IP, source port, destination port and protocol, by the splitcap tool, and traffic data packets with the same five-tuple are obtained.

[0043] In some embodiments of the present invention, the Bi-gram language model is used to form a token string composed of different tokens from a string of hexadecimal messages in a data packet.

[0044] In some embodiments of the present invention, the mapping dictionary stores the mapping relationship between tokens and characters. The mapping dictionary maps each token in the token string to the corresponding character based on the pre-stored mapping relationship to obtain the mapping string of the corresponding token string.

[0045] The above approach is adopted because traffic data is often parsed in the form of hexadecimal strings, which contain the content of the message header and payload. However, due to the processing of protocol specifications and privacy encryption technologies, this form of representation is often difficult to directly associate with its behavior and thus be used for traffic behavior identification. In order to further study the universal expression of traffic data, that is, the construction of the flow spectrum corresponding to the traffic data, this patent adopts the idea of ​​natural language, divides the hexadecimal flow string into units, and forms different tokens from a string of hexadecimal messages based on the Bi-gram language model. At the same time, special identifiers of "beginning, split, padding and end" are added to facilitate subsequent training.

[0046] Step S200: Input the mapping string into the pre-trained model, and perform dimensionality-upgrading representation on each character in the mapping string to obtain the flow spectrum mapping matrix;

[0047] In some embodiments of the present invention, the pre-trained model is a preset transformer model;

[0048] In the specific implementation process, the transformer model is preset to raise each character to 768 dimensions. If the input mapping string is a string of length 128, then each string in the mapping string is raised to 768 dimensions to obtain a 128*768 matrix, which is the stream spectrum mapping matrix.

[0049] Step S300: Input the stream spectrum mapping matrix corresponding to each data packet into multiple preset classification models simultaneously to obtain classification results;

[0050] In the specific implementation process, the preset multiple classification models are all classifier models, and each classifier model is used to handle different classification tasks.

[0051] In practice, the classifier model can be a softmax classification model.

[0052] Step S400: Combine each classification model with the pre-trained model to form a concatenated model. Calculate the loss function using the classification result corresponding to each classification model. Update the model parameters of each concatenated model using the backpropagation algorithm to obtain the pre-trained model that has completed training.

[0053] In the specific implementation process, in the step of combining each classification model with the pre-trained model into a concatenated model, if the pre-trained model is a transformer model and the classification model is a softmax classification model, then the transformer model is combined with each softmax classification model into a concatenated model.

[0054] In the specific implementation process, the loss function of the splicing model can be calculated using the cross-entropy loss function. Then, the model parameters of multiple splicing models are updated synchronously through the backpropagation algorithm, thereby improving the training efficiency of the pre-trained model and obtaining a pre-trained model that can complete accurate encoding. When a new classification task needs to be solved, technicians only need to splice a new classifier after the pre-trained model and then complete the overall training of the new model through a small-scale training. Compared with the traditional method of directly training the overall model through large-scale labeled data, this method can effectively improve training efficiency.

[0055] Using the above scheme, the pre-trained model can represent each character in the mapped string in higher dimensions, perform stream spectrum mapping, and obtain a stream spectrum mapping matrix, which encodes the string. This allows for pre-training of the encoding part of the streaming data analysis task. When a classification task is required, technicians only need to concatenate the classifier for the corresponding classification task into the pre-trained model. Since the pre-trained model has already completed the training of the encoding, only a small amount of labeled data is needed to train the concatenated model as a whole after concatenating the classifier. Therefore, this method can effectively improve training efficiency.

[0056] In some embodiments of the present invention, before the step of converting the initial string of each data packet into a token string including multiple tokens based on the Bi-gram model, the method further includes converting the corresponding binary data of each data packet into hexadecimal data, and using the resulting hexadecimal data as the initial string.

[0057] like Figure 2 As shown, in some embodiments of the present invention, in the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into multiple preset classification models, the multiple classification models include a hidden state prediction model, which outputs the predicted hidden state based on the input stream spectrum mapping matrix.

[0058] In the specific implementation process, the hidden state of the data packet output by the hidden state prediction model is compared with the actual hidden state of the data packet. The actual hidden state is obtained through a clustering algorithm, which can be the K-means clustering algorithm.

[0059] In some embodiments of the present invention, in the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a hidden state prediction model, then the loss function is calculated based on the predicted hidden state output by the hidden state prediction model and the hidden state label of the data packet.

[0060] In the specific implementation process, the hidden state prediction model calculates the probability of the data packet belonging to each hidden state, and outputs the hidden state corresponding to the highest probability as the final predicted hidden state. In the step of calculating the loss function, if the prediction is correct, the probability value corresponding to the hidden state is included in the calculation of the loss function; if the prediction is wrong, it is counted as 0. Based on the above scheme, all data packets in the multiple data packets are calculated, and the negative number of the sum of the calculated values ​​included in the loss function is used as the loss function value.

[0061] In some embodiments of the present invention, the steps preceding the step of calculating the loss function based on the predicted hidden state output by the hidden state prediction model and the hidden state label of the data packet further include:

[0062] Obtain the size of each data packet and the time interval between each data packet and the previous data packet in the plurality of data packets;

[0063] Calculate the logarithm of the interval time;

[0064] Based on the size of each data packet and the logarithm of the interval time, construct two-dimensional coordinates for each data packet;

[0065] The two-dimensional coordinates corresponding to the multiple data packets are clustered using a clustering algorithm to obtain the hidden state label of each data packet.

[0066] Each category in the clustering algorithm corresponds to a hidden state label.

[0067] In the specific implementation process, in the step of obtaining the size of each data packet and the interval between each data packet and the previous data packet, the data packets are parsed using software such as Wireshark, Scapy, or FlowContainer to determine the size of each data packet and the interval between each data packet and the previous data packet.

[0068] In the specific implementation process, the natural constant is used as the base in the step of calculating the logarithm of the interval time.

[0069] In the specific implementation process, in the step of constructing two-dimensional coordinates for each data packet based on the size of each data packet and the logarithm of the interval time, the size of each data packet and the logarithm of the interval time are respectively used as parameters for the two dimensions of the two-dimensional coordinates.

[0070] In the specific implementation process, in the step of clustering the two-dimensional coordinates corresponding to the multiple data packets using a clustering algorithm to obtain the hidden state label of each data packet, the two-dimensional coordinates can be clustered using the K-means clustering algorithm, and the most suitable cluster value can be found based on the total sum of squared distances, silhouette coefficient, CH index or Davidson-Bolding index.

[0071] like Figure 2 As shown, in some embodiments of the present invention, if the plurality of classification models include a message unit prediction model, then the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into the preset plurality of classification models includes:

[0072] Replace any column in the stream spectrum mapping matrix, and input the replaced stream spectrum mapping matrix into the message unit prediction model;

[0073] The message unit prediction model identifies the replacement results for columns based on the input stream spectrum mapping matrix.

[0074] In some embodiments of the present invention, in the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a message unit prediction model, then the loss function is calculated based on the replacement result identified by the message unit prediction model and the actual replacement result.

[0075] In the specific implementation process, the message unit prediction model calculates the probability of each column in the stream spectrum mapping matrix being replaced, and outputs the replacement result corresponding to the highest probability as the replacement result identified by the message unit prediction model. If the replacement result identified by the message unit prediction model is correct, the probability value corresponding to the replacement result is included in the calculation of the loss function. If the prediction is wrong, it is counted as 0. Based on the above scheme, all data packets in the multiple data packets are calculated, and the negative of the sum of the calculated values ​​included in the loss function is used as the loss function value.

[0076] like Figure 2 As shown, in some embodiments of the present invention, if the plurality of classification models include a load prediction model, the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into the preset plurality of classification models includes:

[0077] Obtain the columns belonging to the header and load portions of the stream spectrum mapping matrix;

[0078] Replace all columns belonging to the header or load portion in the flow spectrum mapping matrix, and input the replaced flow spectrum mapping matrix into the load prediction model;

[0079] The load prediction model identifies the replacement result of the header or load portion based on the input flow spectrum mapping matrix.

[0080] In some embodiments of the present invention, in the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a load prediction model, then the loss function is calculated based on the replacement result of the header or load portion identified by the load prediction model and the actual replacement result of the header or load portion.

[0081] In the specific implementation process, the load prediction model calculates the probability that a column in the packet header or a column in the load portion of the stream spectrum mapping matrix will be replaced, as well as the probability that neither column will be replaced. The replacement result corresponding to the highest probability is output as the replacement result identified by the load prediction model. If the replacement result identified by the load prediction model is correct, the probability value corresponding to the replacement result is included in the calculation of the loss function. If the prediction is wrong, it is counted as 0. Based on the above scheme, all data packets in the multiple data packets are calculated, and the negative of the sum of the calculated values ​​included in the loss function is used as the loss function value.

[0082] In the specific implementation process, the initial string is marked with a header part and a load part. If this mark is retained in the token string, then the stream spectrum mapping matrix will also be marked with columns for the header part and columns for the load part.

[0083] like Figure 2 As shown, in some embodiments of the present invention, the preset multiple classification models simultaneously include a load prediction model, a message unit prediction model, and a hidden state prediction model. The pre-trained model is then combined with the load prediction model, the message unit prediction model, and the hidden state prediction model to form three concatenated models. The model parameters of the three concatenated models are updated simultaneously based on the calculated loss function, that is, the model parameters of the pre-trained model are updated simultaneously, thereby improving the training efficiency of the pre-trained model.

[0084] In some embodiments of the present invention, a fully connected layer is added between the pre-trained model and the classification model.

[0085] Existing stream data analysis schemes suffer from low analysis efficiency, low accuracy, high update costs, and high annotation costs. Therefore, this invention can enable pre-trained models to learn the implicit patterns of stream data organization by utilizing a large amount of existing encrypted / unencrypted stream data. By transforming stream data into meaningful embedded representations, it can achieve universal processing of stream data and provide effective support for subsequent behavioral analysis of streams.

[0086] The beneficial effects of this invention include:

[0087] 1. This invention is based on the idea of ​​natural language processing. It compares traffic data with text data and uses a pre-trained model to analyze and process the traffic data in order to learn the organizational mapping pattern between the traffic data. Its advantage lies in comparing "protocol paradigm, stream, packet, message" with "grammar, paragraph, sentence, word" and using a language model to process traffic data, providing a new solution for traffic data parsing.

[0088] 2. To learn the organizational patterns among streaming data, this invention designs three pre-training subtasks: message unit prediction, load association prediction, and hidden state prediction. Through character-level, packet-level, and stream-level learning, it comprehensively learns the relationships between, within, and between streaming data and the content it represents. Compared with other solutions, this solution combines the advantages of expert knowledge and end-to-end solutions, while not requiring a large amount of labeled data, and the model is not affected by label bias during training.

[0089] This invention also provides a streaming spectrum mapping device based on a pre-trained model. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method described above.

[0090] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned stream spectrum mapping method based on a pre-trained model. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0091] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0092] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0093] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0094] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A stream spectrum mapping method based on a pre-trained model, characterized in that, The steps of the method include: Multiple data packets with the same quintuple are obtained. The initial string of each data packet is converted into a token string containing multiple tokens based on the Bi-gram model. Each token is mapped to the corresponding character based on a preset mapping dictionary to obtain the mapping string. The mapping string is input into the pre-trained model, and each character in the mapping string is expressed in higher dimensions to obtain the flow spectrum mapping matrix; The stream spectrum mapping matrix corresponding to each data packet is simultaneously input into multiple preset classification models to obtain classification results; Each classification model is combined with a pre-trained model to form a concatenated model. The loss function is calculated using the classification results of each classification model. The model parameters of each concatenated model are updated using the backpropagation algorithm to obtain a pre-trained model that has been trained.

2. The stream spectrum mapping method based on a pre-trained model according to claim 1, characterized in that, Before the step of converting the initial string of each data packet into a token string containing multiple tokens based on the Bi-gram model, the method further includes converting the corresponding binary data of each data packet into hexadecimal data, and using the resulting hexadecimal data as the initial string.

3. The stream spectrum mapping method based on a pre-trained model according to claim 1, characterized in that, In the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into multiple preset classification models, the multiple classification models include a hidden state prediction model, which outputs the predicted hidden state based on the input stream spectrum mapping matrix.

4. The stream spectrum mapping method based on a pre-trained model according to claim 3, characterized in that, In the step of combining each classification model with a pre-trained model into a concatenated model and calculating the loss function based on the classification result corresponding to each classification model, if the concatenated model consists of a pre-trained model and a hidden state prediction model, then the loss function is calculated based on the predicted hidden state output by the hidden state prediction model and the hidden state label of the data packet.

5. The flow spectrum mapping method based on a pre-trained model according to claim 4, characterized in that, The steps preceding the step of calculating the loss function based on the predicted hidden state and the hidden state label of the data packet output by the hidden state prediction model include: Obtain the size of each data packet and the time interval between each data packet and the previous data packet in the plurality of data packets; Calculate the logarithm of the interval time; Based on the size of each data packet and the logarithm of the interval time, construct two-dimensional coordinates for each data packet; The two-dimensional coordinates corresponding to the multiple data packets are clustered using a clustering algorithm to obtain the hidden state label of each data packet.

6. The stream spectrum mapping method based on a pre-trained model according to claim 1, characterized in that, If the multiple classification models include a message unit prediction model, then the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into the multiple preset classification models includes: Replace any column in the stream spectrum mapping matrix, and input the replaced stream spectrum mapping matrix into the message unit prediction model; The message unit prediction model identifies the replacement results for columns based on the input stream spectrum mapping matrix.

7. The stream spectrum mapping method based on a pre-trained model according to claim 6, characterized in that, In the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a message unit prediction model, then the loss function is calculated based on the replacement result identified by the message unit prediction model and the actual replacement result.

8. The stream spectrum mapping method based on a pre-trained model according to claim 1, characterized in that, If the multiple classification models include a load prediction model, then the step of simultaneously inputting the stream spectrum mapping matrix corresponding to each data packet into the multiple preset classification models includes: Obtain the columns belonging to the header and load portions of the stream spectrum mapping matrix; Replace all columns belonging to the header or load portion in the flow spectrum mapping matrix, and input the replaced flow spectrum mapping matrix into the load prediction model; The load prediction model identifies the replacement result of the header or load portion based on the input flow spectrum mapping matrix.

9. The stream spectrum mapping method based on a pre-trained model according to claim 8, characterized in that, In the step of combining each classification model with a pre-trained model into a splicing model and calculating the loss function based on the classification result corresponding to each classification model, if the splicing model consists of a pre-trained model and a load prediction model, then the loss function is calculated based on the replacement result of the header or load portion identified by the load prediction model and the actual replacement result of the header or load portion.

10. A stream spectrum mapping device based on a pre-trained model, characterized in that, The device includes a computer device, which includes a processor and a memory, wherein computer instructions are stored in the memory, and the processor is configured to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the method as described in any one of claims 1-9.

Images