An unknown threat identification method based on adaptive snapshot integration

Abstract

The application discloses an unknown threat identification method based on adaptive snapshot integration, which is applied to instant fine classification of network encrypted traffic and can identify unknown threats caused by concept drift. The method comprises an encrypted traffic preprocessing and feature extraction module, an encrypted traffic time sequence feature neural network classification module, a new category traffic discrimination module, a snapshot integration module and a transfer learning module. The method can cope with increasing unknown abnormal traffic, give unknown abnormal traffic clustering results for experts to mark, effectively solve the concept drift and category imbalance problem, and thus guarantee the reliability of abnormal traffic detection.

Description

Technical Field

[0001] This invention relates to a method for identifying unknown threats based on adaptive snapshot integration, belonging to the field of information security technology. Background Technology

[0002] Network intrusion detection identifies malicious traffic through traffic analysis to detect intrusions. With the development of the internet age, attacks such as insider threats, zero-day vulnerabilities, and DoS attacks are increasing, making network security increasingly important and a key research area in the field. It can detect network activity without impacting network performance, providing real-time protection and offering timely decision-making assistance to network security professionals by identifying attack types. Deep learning-related solutions offer greater flexibility and more powerful detection capabilities, and their capabilities can be expanded with more training data.

[0003] When using deep learning models to solve the problem of fine-grained classification of malicious traffic, the constantly emerging categories of malicious traffic force network service regulators to continuously change the network structure to adapt to the classification task of these new categories. In an era of ever-increasing traffic data volume, the time consumption of rebuilding the network structure and training the model is unacceptable.

[0004] Furthermore, even when traditional transfer learning methods are used to adapt to the constantly increasing categories, these classifiers may still gradually age and fail due to adversarial attacks, concept drift, and other issues. At the same time, newly added malicious traffic categories typically constitute a small proportion of the collected traffic; directly using them for training will also result in poor classification performance for these categories, failing to achieve the task of identifying and classifying newly added malicious traffic. Summary of the Invention

[0005] Technical issue: This invention addresses the framework update problem for detecting newly added unknown malicious traffic.

[0006] Technical Solution: To address the above problems, this invention discloses an identification method, specifically an unknown threat identification method based on adaptive snapshot integration, comprising the following steps:

[0007] S1, Extracting Traffic Features: Extracting temporal and statistical features from encrypted network traffic, which are used as input for the next stage detector.

[0008] S2, a deep learning classifier for detecting known malicious traffic: It inputs past encrypted traffic data into the training model, reduces model variance through ensemble learning, and can classify traffic in a new time period.

[0009] S3, Unknown Traffic Clustering: Samples with the highest confidence score below a threshold are marked as unknown samples, then clustered into new categories and subsequently labeled.

[0010] S4, Transfer learning modifies the network structure: By reusing the parameters of the previous stage's neural network and changing the number of nodes in the output layer, the classification model can be used to predict new categories.

[0011] S5, Snapshot Learning and Oversampling: Data labeled with new categories is oversampled and re-inputted into the neural network for training, preserving snapshots of local optima at each training stage. Ensemble learning is used to achieve better model performance.

[0012] As an improvement to the present invention, step S1 further includes:

[0013] S11 cleaning yields clean traffic data. For each encrypted stream, the data packet lengths are recorded sequentially and concatenated to form a time-series feature sequence. Various statistical feature vectors are then calculated.

[0014] S12 takes the traffic data with obtained statistical and time-series information, constructs the size of each batch of data for the input model based on the real-time received traffic size, and then adjusts the size of each batch of traffic based on the subsequently provided signals, thereby constructing sufficiently heterogeneous different models.

[0015] As an improvement of the present invention, step S2 further includes:

[0016] S21 constructs a convolutional neural network and uses cosine annealing to update the gradient in order to achieve a better sub-model.

[0017] S22 preserves snapshots of the model parameters during training. These snapshots are then used to build base classifiers for ensemble learning. A deep learning classifier for malicious traffic detection is then constructed using these snapshot ensembles.

[0018] As an improvement to the present invention, step S3 further includes:

[0019] S31 sets a reasonable threshold and extracts all samples whose highest confidence level in the malicious traffic detection deep learning classifier's predicted category is below that threshold. These samples are then clustered using DBSCAN to obtain their new categories.

[0020] S32 calculates the center value of each category of the normal classification samples in this batch, compares the deviation of the new category cluster centers obtained by DBSCAN clustering with the center centers of the normal samples, and assigns the new cluster categories with deviations less than a threshold to the known classification categories. The rest are treated as new categories for training in stage S4.

[0021] S33 uses expert evaluation and other methods to label the final new category determined in stage S32 for subsequent use. This step can be executed in parallel with the overall process without affecting each other.

[0022] As an improvement of the present invention, in step S4, the number of nodes in the last layer of the convolutional neural network, i.e. the output layer, is increased to be the same as the current total number of categories, and the last layer with the increased number of neurons still maintains a fully connected state with the previous layer.

[0023] As an improvement to the present invention, step S5 further includes:

[0024] S51 uses the SMOTE algorithm to oversample samples labeled as new categories, mitigating the class imbalance problem of these new categories and obtaining the dataset for retraining in S52.

[0025] S52 utilizes transfer learning to reuse the model parameters of the optimal sub-model from stage S21. It then retrains the model using unlabeled samples with newly labeled classifiers, resulting in a fine-grained classifier model adapted to new categories of malicious traffic. Simultaneously, it retains snapshots of the model during retraining for use in constructing new deep learning classifiers for malicious traffic detection.

[0026] Based on the number of snapshots generated in stage S52, S53 selects an appropriate number of the remaining snapshot sub-models generated in stage S21, and repeats the operation of S51 for each sub-model to ultimately construct an appropriate number of snapshot sub-models adapted to the new category.

[0027] S54 constructs a new deep learning classifier for malicious traffic detection by integrating the snapshot sub-model obtained from S53.

[0028] S55 calculates and judges the heterogeneity between snapshots by recording the number of snapshots in S21 used in S53. When the heterogeneity does not meet the requirements, it dynamically adjusts the number of samples in each batch in S12 by using detection data over a longer period of time, so that the number of generated snapshots meets the requirements for selecting a sufficient number of heterogeneous models.

[0029] Beneficial Effects: Compared with existing technologies, we organically integrate the advantages of snapshot ensemble, oversampling, and transfer learning, reducing model time complexity while effectively solving the problems of concept drift and unknown malicious traffic in encrypted traffic. The overall process utilizes the proposed heterogeneity model selection method, training sample quantity adjustment method, and unknown sample screening method, enabling the model to adaptively adjust and optimize the aforementioned aspects, achieving wide application of the model in different scenarios. Furthermore, the overall process does not require excessive expert knowledge; after initialization, it can adaptively adjust the snapshot model generation and training strategies to continuously handle new real-time traffic. Attached Figure Description

[0030] Figure 1 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0031] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the present invention.

[0032] Example 1: As Figure 1 As shown, an unknown threat identification method based on adaptive snapshot ensemble includes the following steps:

[0033] S1 extracts flow characteristics:

[0034] Feature extraction from traffic data significantly impacts the learning performance of subsequent models and is an indispensable step. In the era of the Internet of Things, network data storage capabilities have increased, enhancing the ability to store, analyze, and process traffic data. Current feature extraction focuses more on extracting time-series information to address the challenges of handling large, complex, and evolving data streams. During model initialization, experts need to label the data, and training is performed using labeled data. In subsequent training iterations, only feature extraction is required.

[0035] Step (1) of encrypted traffic preprocessing and feature extraction includes the following sub-steps:

[0036] (1.1) The collected traffic is cleaned, and time statistical features are constructed by calculating the number, minimum, median, mean, maximum, and mean absolute variance. By dividing the time into 50ms segments, the first 9 segments and the remaining 1 segment are constructed, and a 10×10 Markov transformation matrix is ​​constructed to build time interval sequence features.

[0037] (1.2) Based on the collected traffic, the amount of data for each training session is reasonably divided to ensure that the amount of data in each batch is consistent with the amount of real-time data and to meet the real-time requirements. During offline training, multiple batches are reasonably selected for training based on experience and subsequent signals to obtain more robust training results.

[0038] S2 Known Class Malicious Traffic Detection Deep Learning Classifier:

[0039] Malicious traffic detection solutions for known types are now very mature. Current deep learning methods have achieved optimal performance across various aspects and are the mainstream solution.

[0040] However, the inherent high variance of deep learning raises questions about model stability. Therefore, this solution's known-class malicious traffic detection will utilize ensemble learning to integrate the results of multiple good but different models, making the model's classification results more reliable. Furthermore, the introduction of snapshot ensemble further reduces the time overhead required for deep learning model ensemble.

[0041] Step (2) specifically includes the following sub-steps:

[0042] (2.1) Construct the number of input and output layer nodes of the model based on the size of the feature matrix and the number of output categories. For the feature matrix composed of extracted statistical and temporal information, since dense features do not need to be extracted and the dimensions are usually large, residual convolutional neural networks, i.e., RESNET, are generally used for sampling. The cross-layer connection blocks used are three-layer BottleBlock structures. Before each block is calculated, a 1×1 convolutional layer is used for dimensionality reduction. Then, the corresponding block output layer is calculated and restored by a 1×1 convolution. The model consists of multiple cross-layer connection blocks, and pooling is performed at the end of the model using Average Pool.

[0043] (2.2) Save the model after every few iterations during the training process, select several of the better models for each cosine period, and use voting ensemble learning to integrate their voting results.

[0044] The specific symbolic representation is as follows: The temporal feature sequence obtained in (1) is fed into the known class malicious traffic detection deep learning classifier to obtain each model M. k For each sample X i Belongs to category {C1,C2,C3,……,C} m The classification results of}, and each sample X i Belongs to a certain category C j With confidence The average confidence level s for each class is obtained by averaging the results of all models. ij The sample belongs to the category with the highest average confidence level. Here, we directly judge the merits and select the superior sub-model, i.e., the computational accuracy: Select the p models with the highest accuracy.

[0045] S3 Unknown Traffic Clustering:

[0046] In actual system operation, due to the continuous iteration and updating of network intrusion methods, many unknown attacks are often encountered, awaiting expert labeling and corresponding countermeasures. Furthermore, even if unknown samples are obtained directly based on classification confidence, the question of how to determine the number of categories remains. Additionally, even if the confidence level is below a certain threshold, it may be due to limitations in the model's fitting ability, or the samples may be difficult samples.

[0047] Step (3) specifically includes the following sub-steps:

[0048] (3.1) Let each sample X i The highest confidence level, i.e., the confidence level of the classification label, is If the value is less than the set threshold δ, it will be removed and identified as unknown traffic.

[0049] (3.2) Then, by using DBSCAN to cluster the unknown samples, the cluster centers C are observed. l Distance to known class {C1,C2,C3,……,C} m The distance between the cluster centers of} is calculated as cosine similarity. When the distance between the centers of all clusters is greater than the threshold ε, it is identified as a new cluster and labeled; if the distance is less than the threshold, the corresponding cluster sample is labeled with the cluster of the nearest known cluster.

[0050] (3.3) We will give each cluster of unknown samples obtained from our clustering to experts to label them in order to obtain subsequent response and prevention measures.

[0051] S4 transfer learning changes the network structure:

[0052] After obtaining the existence of unknown classes, the number of unknown classes, and the corresponding samples, since the output of the deep learning model is fixed and retraining the model requires a significant amount of time, transfer learning is used to modify the network structure to adapt to the new total number of classes obtained in the previous stage. In this process, we aim to reuse the previous training results.

[0053] Step (4) uses the sample label data considering unknown categories obtained in step (3) to derive the improved model after transfer learning.

[0054] The specific symbolic representation is as follows:

[0055] The previous training model output had n categories, the last layer of the model had n neurons, and the number of newly added unknown malicious traffic categories was n. τ Then the number of neurons in the last layer of the model is adjusted to n+n. τ And ensure that the connection between it and the previous layer remains fully connected. If the last layer is a softmax layer, adjust the number of neurons to the last two layers, and they still maintain full connectivity with the third-to-last layer. Parameters of the remaining layers of the model. It remains unchanged.

[0056] S5 Snapshot Learning and Oversampling

[0057] Since the newly added category only appears in the current time period, it will inevitably be a small category relative to all the training data, resulting in a serious class imbalance problem. Furthermore, snapshot ensemble is needed to reduce model variance; therefore, the design of how to obtain a new snapshot from several existing snapshots requires careful consideration.

[0058] Step (5) specifically includes the following sub-steps:

[0059] (5.1) The SMOTE algorithm is used to oversample the samples labeled as new categories to alleviate the class imbalance problem of new categories and obtain data for retraining the model. Since the number of new category samples is small, it is easy to introduce bias when the clustering results are directly used as labels to generate new samples. Here, when the number of new category samples is less than the number of categories, the same signal to increase the sample size is issued.

[0060] (5.2) The classification loss MSE of individual models and ensemble models is calculated: The optimal single sub-model is obtained. The model structure is changed using the transfer learning proposed in (4), the model is trained using the training data obtained in (5.1), the model is trained using the model training steps in (2) and the corresponding snapshot is obtained, and then a set of models with both high accuracy and sufficient heterogeneity is selected. The selection process is as follows: a model M is randomly selected. r Then calculate M for each model. k With the selected model M r The average cosine similarity of the prediction results Select the model with the lowest similarity and construct a set R with the initially selected model. Then, repeatedly calculate the average cosine similarity between the remaining models and each model in set R, selecting the model with the lowest similarity, until the lowest similarity is above a threshold.

[0061] (5.3) Snapshots derived from a single model often exhibit bias. If the quality of the snapshot generated based on a single optimal sub-model is inadequate, the model {M1, M2, ..., M...} will be biased. j}Calculate the MSE according to (5.2) and sort them. Repeat the steps of (5.2) for several better models until the generated models are good enough and diverse.

[0062] (5.4) The sufficiently diverse snapshots obtained are used in a similar manner to (2.2) to obtain a new deep learning classifier for malicious traffic detection through voting integration.

[0063] (5.5) By recording the number of snapshots generated by each model in stages (5.3) and (5.4), the number of samples selected in stage (1.2) is dynamically adjusted. By increasing the number of samples, the number of snapshots generated by each model during training is increased.

[0064] The technical means disclosed in this invention are not limited to those disclosed in the above-described embodiments, but also include technical solutions composed of any combination of the above technical features.

Claims

1. A method for identifying unknown threats based on adaptive snapshot ensemble, characterized in that... The method includes the following steps: S1, Extracting Traffic Features: Extracting temporal and statistical features from encrypted network traffic, which are used as input for the next stage detector. S2, a deep learning classifier for detecting known malicious traffic: Encrypted traffic data labeled by experts is input into the training model. Through ensemble learning, the model variance is reduced, and it can classify traffic in a new time period. S3, Unknown Traffic Clustering: Samples with the highest confidence score below a threshold are marked as unknown samples, then clustered into new categories and subsequently labeled. S4, Transfer learning modifies the network structure: By reusing the parameters of the previous stage's neural network and changing the number of nodes in the output layer, the classification model can be used to predict new categories. S5, Snapshot Learning and Oversampling: Data labeled with new categories is re-inputted into the neural network for training through oversampling. Snapshots of local optima at each stage of training are preserved, and ensemble learning is used to enable the model to achieve better performance. Step S2 further includes: S21 constructs a convolutional neural network and trains it using a cosine annealing learning rate to achieve a better sub-model. S22 preserves snapshots of the model parameters at each cosine stage during training. Using these snapshots, a base classifier for ensemble learning is constructed. The snapshots are then used to ensemble and construct a deep learning classifier for malicious traffic detection. Step S3 further includes: S31 sets a reasonable threshold and extracts all samples whose highest confidence level in the malicious traffic detection deep learning classifier's predicted category is below that threshold. These samples are then clustered using DBSCAN to obtain their new categories. S32 calculates the center value of each category of the normal classification samples in this batch, compares the deviation of the new category cluster centers obtained by DBSCAN clustering with the center centers of the normal samples, assigns the new cluster categories with deviations less than the threshold to the known classification categories, and treats the rest as new categories for training in stage S4. S33 uses expert evaluation to label the final new category determined in stage S32 for subsequent use.

2. The method for identifying unknown threats based on adaptive snapshot ensemble as described in claim 1, characterized in that: Step S1 further includes: S11 cleaning yields clean traffic data. For each encrypted stream, the data packet lengths are recorded sequentially and concatenated to form a time-series feature sequence. Various statistical feature vectors are then calculated. S12 takes the traffic data with obtained statistical and time-series information, constructs the size of each batch of data for the input model based on the real-time received traffic size, and then adjusts the size of each batch of traffic based on the subsequently provided signals, thereby constructing sufficiently heterogeneous different models.

3. The method for identifying unknown threats based on adaptive snapshot integration as described in claim 1, characterized in that: In step S4, the number of neurons in the last layer of the convolutional neural network, i.e. the output layer, is increased to be the same as the current total number of categories. The last layer with the increased number of neurons remains fully connected to the previous layer. If no new category is detected in this stage, the batch size of each epoch in stage S12 is dynamically adjusted by using detection data over a longer period of time, thereby increasing the amount of data in each training stage.

4. The method for identifying unknown threats based on adaptive snapshot ensemble as described in claim 1, characterized in that: Step S5 further includes: S51 uses the SMOTE algorithm to oversample samples labeled as new categories, mitigating the class imbalance problem of these new categories and obtaining the dataset for retraining in S52. S52 utilizes transfer learning to reuse the model parameters of the optimal sub-model from stage S21. It then retrains the model using unlabeled samples with newly labeled classifiers, resulting in a fine-grained classifier model adapted to new categories of malicious traffic. Simultaneously, it retains snapshots of the model during retraining for constructing new deep learning classifiers for malicious traffic detection. Based on the number of snapshots generated in stage S52, S53 selects an appropriate number of the remaining snapshot sub-models generated in stage S21, and repeats the operation of S51 for each sub-model to ultimately construct an appropriate number of snapshot sub-models adapted to the new category. S54 integrates the snapshot sub-model obtained from S53 using the average output probability distribution or majority voting to construct a new deep learning classifier for malicious traffic detection. S55 calculates and judges the heterogeneity between snapshots by recording the number of snapshots in S21 used in S53. When the heterogeneity does not meet the requirements, it dynamically adjusts the number of samples in each batch in S12 by using detection data over a longer period of time, so that the number of generated snapshots meets the requirements for selecting a sufficient number of heterogeneous models.

Images