Fine-grained malicious traffic classification method and system based on contrast incremental learning

Abstract

The present application belongs to the technical field of network information security, and particularly relates to a fine-grained malicious traffic classification method and system based on contrast incremental learning, which combines contrast learning, incremental learning and malicious traffic identification, acquires latent space features through the encoding network of a variational autoencoder, and combines contrast learning and incremental learning to perform high-performance fine-grained classification and identification of known, small sample, unknown and newly added malicious classes, stores and reconstructs the knowledge on the original task using the variational autoencoder, and combines the knowledge distillation mechanism to realize the rapid learning and identification of newly added malicious traffic without using a large amount of training data on the original task, thereby meeting the defense needs of various known and unknown threats emerging in the network system. The present application can ensure detection efficiency while rapidly identifying new threats, greatly reducing training costs and the risk of data poisoning attacks, and meeting the high-speed and high-precision malicious traffic classification and identification application in network information security.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network information security, and particularly relates to a fine-grained malicious traffic classification method and system based on comparative incremental learning. BACKGROUND

[0002] Flow-based network intrusion detection systems (NIDS) are one of the most important security devices in the field of cyberspace security, and have been widely used in the protection of various information systems. With the rapid development of mobile Internet and Internet of Things (IoT), the types and number of terminal devices are increasing. However, resource-constrained terminal devices cannot deploy security software or agents and have many vulnerabilities, making flow-based threat detection more important. This trend highlights the importance of NIDS.

[0003] The most important function of NIDS is to classify network traffic and identify malicious traffic. Current traffic classification methods mainly include port-based, payload inspection-based, and flow-based methods. However, the first two methods often struggle to detect increasingly sophisticated network attacks. For example, dynamic ports, port obfuscation, and port hopping techniques significantly reduce the accuracy of port-based methods. The widespread use of encryption technology makes payload-based methods that rely on deep packet inspection (DPI) almost completely ineffective. In addition, privacy and computational overhead are also drawbacks of payload-based methods. Flow-based methods do not have the above problems, and with the rapid development of machine learning, this method has become the most popular method today due to its wide range of use, high classification performance, and ability to identify encrypted traffic.

[0004] However, existing machine learning-based methods, although high in performance, are subject to fixed data in the training process. In practice, new types of applications or threats continue to emerge, generating various new types of benign or malicious traffic, making it difficult for traditional methods to cope. Fine-grained traffic identification is also necessary. In stream-based malicious traffic identification, more fine-grained classification can provide more threat-related information to help security experts respond quickly. However, in fine-grained traffic identification, there are often small sample classes. How to enable the detection model to simultaneously identify known, small sample, unknown, and new class malicious traffic with high performance and fine granularity is a problem that needs to be solved in the field of malicious traffic identification. SUMMARY

[0005] To this end, the application provides a fine-grained malicious traffic classification method and system based on contrast incremental learning, which solves the problems of existing fine-grained identification of known, small sample, unknown and new class malicious traffic, and provides an effective technical means for security protection of large network systems and key infrastructures from the perspective of traffic.

[0006] According to the design scheme provided by the application, a model training method based on contrast incremental learning is provided, which includes the following contents:

[0007] The latent space features of the sample data are obtained by using the encoding network in the variational autoencoder, the sample data is reconstructed based on the decoding network in the variational autoencoder, and the variational autoencoder reconstruction loss is constructed based on the sample data and the reconstructed sample data;

[0008] The latent space features are projected onto the hypersphere by using the angular projection layer to obtain the hypersphere angular distance features corresponding to the sample data, the angular distance features are classified by using the classifier, and the classifier loss is constructed based on the classification output and the existing labels of the sample data;

[0009] Based on the reconstruction loss and the classifier loss, and introducing the contrast learning loss based on the positive and negative feature spaces of the encoding network, the total loss function for model training is constructed, and the model is trained based on the total loss function.

[0010] As the model training method based on contrast incremental learning in the application, further, the variational autoencoder reconstruction loss is constructed based on the mean square error between the sample data and the reconstructed sample data, including: setting the posterior probability distribution of the latent space features to follow a Gaussian distribution, and constructing the reconstruction loss by using the mean square error between the sample data and the reconstructed sample data.

[0011] As the model training method based on contrast incremental learning in the application, further, it also includes: constructing the difference vector between the sample data and the reconstructed sample data, and identifying unknown malicious categories based on the extreme value theory model.

[0012] As the model training method based on contrast incremental learning in the application, further, in the classifier loss, based on the classification output and the existing labels of the sample data, and using A-Softmax function to construct the classifier loss; the contrast learning loss is represented by InfoNCE loss.

[0013] As the model training method based on contrast incremental learning in the application, further, the total loss function is expressed as: wherein, , is a weight hyperparameter, , , These represent the reconstruction loss, classifier loss, and contrastive learning loss, respectively.

[0014] As a model training method based on contrastive incremental learning in this invention, it further includes: utilizing knowledge distillation to transfer network parameters, benign class, malicious class training samples, and the normal distribution of the variational autoencoder from the trained model; jointly constructing a new model loss function by combining newly added class sample data; and using the new model loss function to jointly train a new classification model, wherein the new model loss function... Represented as: , , , For weight hyperparameters, , , , denoted as reconstruction loss, classifier loss, contrastive learning loss, and knowledge distillation soft decision vector learning loss, respectively.

[0015] Furthermore, the present invention also provides a fine-grained malicious traffic classification method based on contrastive incremental learning, comprising the following:

[0016] A malicious traffic classification model is constructed based on contrastive incremental learning and variational autoencoder, and the above model training method is used to train the malicious traffic classification model.

[0017] Monitor and collect target network traffic, and input the target network traffic data into a trained malicious traffic classification model. Use the trained malicious traffic classification model to classify and identify the category of target network traffic.

[0018] Furthermore, the present invention also provides a fine-grained malicious traffic classification system based on contrastive incremental learning, comprising: a model building module and a traffic identification module, wherein,

[0019] The model building module is used to build a malicious traffic classification model based on contrastive incremental learning and variational autoencoder, and to train the malicious traffic classification model using the above model training methods.

[0020] The traffic identification module is used to monitor and collect target network traffic, and input the target network traffic data into the trained malicious traffic classification model to classify and identify the category of target network traffic.

[0021] The beneficial effects of this invention are:

[0022] The application combines contrastive learning, incremental learning and malicious traffic identification, can end-to-end realize high-performance fine-grained classification and identification of known, small sample, unknown and new malicious classes, can quickly learn and identify new malicious traffic without using a large amount of training data on the original task by using the knowledge distillation mechanism, meets the defense needs of various known and unknown threats in the network system, realizes the storage and extraction of old class knowledge by combining contrastive learning and the generation characteristics of the VAE model, realizes the identification of new threats on the premise of ensuring detection efficiency, reduces the training cost and the risk of data poisoning attacks, and meets the high-speed and high-precision malicious traffic classification and identification application in network information security. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 The figure is a model training process based on contrastive incremental learning in the embodiment;

[0024] Figure 2 The figure is a malicious traffic classification model principle architecture in the embodiment;

[0025] Figure 3 The figure is a fine-grained malicious traffic classification and identification algorithm process in the embodiment. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical scheme and advantages of the application more clear and explicit, the application will be further described in detail below in combination with the drawings and technical scheme.

[0027] Traffic classification is an open set recognition problem. Unknown attacks, such as new malware variants, zero-day attacks, and various attacks on emerging technologies such as IoT that have not been seen in the training phase, are growing rapidly, generating various unknown malicious traffic. A new generation of NIDS needs to be able to cope with the challenge of unknown traffic at any time. The experimental results of previous traffic recognition methods are obtained on a closed set, and the detection of unknown classes is not fully considered. Traffic classification is also an incremental learning problem. Various new types of traffic are constantly being added, and NIDS needs to be able to continuously and uninterruptedly identify them. In this scenario, the detection model needs to be trained at any time when new classes are added. If traditional machine learning does not handle the distribution of data continuously, it will have a catastrophic forgetting problem, that is, it will forget the knowledge of old classes when learning new classes. In practice, previous (joint learning) methods need to maintain a large dataset containing all old classes or retain all old task model parameters, which may have the risk of data poisoning or tampering. And every time a new class of traffic is learned, the model needs to be retrained, resulting in increasing time, maintenance and storage overhead, making it difficult to meet the real-time requirements. Current research lacks consideration of the incremental learning scenario. Traffic classification is also a coarse-to-fine few-shot (C2FS) problem. The classification performance of deep learning depends heavily on the amount and quality of training data. However, in practical applications, there is often not enough labeled data available due to the high cost of labeling data or unknown attacks. Previous methods have not considered this demand. Therefore, the embodiment of the present case provides a model training method based on contrastive incremental learning, as shown in Figure 1 , which comprises:

[0028] S101, using the encoding network in the variational autoencoder to obtain the latent space features of the sample data, using the decoding network in the variational autoencoder to reconstruct the sample data based on the latent space features, and using the sample data and the reconstructed sample data to construct a variational autoencoder reconstruction loss;

[0029] S102, projecting the latent space features onto a hypersphere using an angular projection layer to obtain the hypersphere angular distance features corresponding to the sample data, using a classifier to classify the angular distance features, and using the classification output and the existing labels of the sample data to construct a classifier loss;

[0030] S103, based on the reconstruction loss and the classifier loss, and introducing a contrastive learning loss based on the positive and negative feature spaces of the encoding network to construct a total loss function for model training, and training the model based on the total loss function.

[0031] The latent space features are obtained through the encoding network of the variational autoencoder, and the contrast learning is introduced to reduce the complexity of model training and improve the classification and prediction performance of the model, so that it can also be applied to fine-grained benign, malicious, unknown and other fine-grained traffic classification identification under small sample conditions.

[0032] Further, the variational autoencoder reconstruction loss is constructed based on the mean square error between the sample data and the reconstructed sample data, including: setting the posterior probability distribution of the latent space features to follow a Gaussian distribution, and using the mean square error between the sample data and the reconstructed sample data to construct the reconstruction loss. Based on the classification output and the existing labels of the sample data, and using the A-Softmax function to construct the classifier loss. The contrast learning loss based on the positive and negative feature spaces of the encoding network is represented by the InfoNCE loss. And by constructing the difference vector between the sample data and the reconstructed sample data, the unknown malicious category is identified based on the extreme value theory model. For malicious traffic identification under new task conditions, knowledge distillation can be used to transfer network parameters, benign categories, malicious training samples and normal distribution of the variational autoencoder in the trained model, and joint new category sample data to jointly construct a new model loss function, and use the new model loss function to jointly train a new classification model.

[0033] Referring to Figure 2 , the overall architecture of the model is divided into two parts: malicious traffic identification on the old task and malicious traffic identification on the new task. The classification model structure is the same, and both include known and unknown malicious traffic identification stages. First, on the old task, the classification model is trained using sample and its corresponding labels. In the known class identification stage, the model uses the VAE model, and designs the contrast loss to train the VAE encoder , so that different class samples are further distinguished in the latent feature space. Then, the angular projection layer function and the A-Softmax function A are used to map the latent features to the label space, and the parameters of are trained with the classification loss. Second, in the unknown class identification stage, the model uses the reconstruction loss to train the VAE decoder , and then uses EVT to identify unknown classes. Finally, on the new task, the model first inherits the initial parameters from the old task model, then uses the knowledge distillation (Knowledge Distillation) loss, and the joint classification loss of the known malicious class samples and the newly added malicious class samples generated by the old VAE model to jointly train the classification model, thereby enabling rapid identification of new classes while maintaining the ability to identify old task categories and unknown classes. The meanings of the symbols in the figure can be shown in Table 1.

[0034] Table 1: Main symbols

[0035]

[0036] Figure 2 The VAE and A-Softmax parts in the model structure on the old task shown, the goal is to train the classification model with old samples and their corresponding labels, so that the prediction results of all class samples are as close to their true labels as possible.

[0037] First, for a given sample feature vector , the posterior distribution of its latent feature z is denoted as , and it is assumed to follow a Gaussian distribution, using approximation simulation. For the VAE model adopted, the reconstruction loss can be:

[0038] (1)

[0039] where are the mean and standard deviation of , respectively, and the VAE uses the encoding network to approximate , and the decoding network to simulate . In practice, the first term of the loss function uses the mean square error (MSE, Mean Square Error) between the original sample and the reconstructed sample .

[0040] Second, A-Softmax can be used to implement traffic classification. For latent feature , use the angular projection layer function to project the latent feature onto the hypersphere, and use the A-Softmax function to classify based on angular distance. Then the classification loss of this part can be expressed as:

[0041] (2)

[0042] where for any , , is an integer hyperparameter.

[0043] Finally, in order to further improve the classification performance of the model, contrastive learning is introduced into the loss function, so that same-class samples are as close as possible and different-class samples are as far apart as possible in this feature space. The loss function of contrastive learning can be in the form of InfoNCE loss, which can be specifically expressed as follows:

[0044] (3)

[0045] Therefore, for all sample pairs on the old tasks, the total loss function of the known stage model is... As shown in equation (4), corresponding to Figure 2 Part ① in the text:

[0046] (4)

[0047] in, and These are all weighted hyperparameters.

[0048] Figure 2 In the model structure of the old task, the EVT part aims to target unknown malicious classes. Sample identification is performed using macros in this embodiment, which employ a VAE decoder combined with EVT.

[0049] After the VAE model is trained, samples from different known classes should be clearly distinguishable in the feature space. If samples The labels predicted by the classification model are correct and classified as benign or known malicious, i.e. and Then, under the contrastive learning strategy, the latent features it encodes... Should approach Latent feature center Close, and its reconstructed sample Also should be with Class-center reconstruction sample Approaching. In this embodiment, the current benign class and the known malicious class ( k+1 independent d-dimensional EVT models were constructed to identify unknown classes.

[0050] EVT posits that for any random variable X, the portion of its extreme values ​​exceeding a threshold t should follow a GPD (Generalized Pareto Distribution):

[0051] (5)

[0052] in, In practical calculations, the maximum likelihood estimation method can be used to calculate the parameters. The log-likelihood function is expressed as follows:

[0053] (6)

[0054] in, This represents the number of samples in the observed data that exceed the threshold t. represents the observation data. In the embodiment of the present case, the error of the same class (benign or known malicious class) sample and its class center is used As the observation data, the current class EVT model parameters corresponding to Figure 2 part ② in the.

[0055] Figure 2 As shown in the model structure part on the new task in , the target is based on the old model of the last step, without using a large number of class data to train a new classification model, so that the new model can predict the prediction results of all class samples as close as possible to their true labels.

[0056] In order to identify the new class samples on the current new task, the structure and training process of the new model are basically the same as the old model. The main difference between the new and old models is that the dimension of the label vector is different (the label dimension on the old task is , and the label dimension on the new task is Figure 2 ). As can be seen from , this parameter only affects the angular projection layer function. Therefore, the initial parameters of other parts of the new model can directly inherit those of the old model, and the angular projection layer function needs to be reinitialized.

[0057] In order to identify the previous class samples without using a large number of original samples, in the embodiment of the present case, there are a VAE reconstruction-based module and a knowledge distillation-based module. First, for small sample classes in the class ( ), since the number of its own samples is small, it will not occupy much storage and computing resources; and for benign classes , it can be easily obtained at any time and does not need to be stored. In this scenario, small sample and benign class samples can be directly applied to the new task, and the knowledge of known malicious classes in the old class ) is transferred through the knowledge distillation technology.

[0058] First, the VAE reconstruction-based module uses the decoder of the old VAE to generate example samples of the old class, as shown in the structure of Figure 2 . Since VAE can generate samples similar to but different from the original samples, the trained VAE can be used to reconstruct the old class samples. Specifically, for the old known malicious class , after the model training is completed, the encoded latent features of all samples of the class are calculated . In the latent feature space of the old VAE model, for the latent feature , which should be close to each other within the same class and far away from each other between different classes under the effect of contrastive learning. The mean and standard deviation of the latent features of the samples in the same class are calculated and stored in a Gaussian distribution . The knowledge of each large-sample malicious class (B) is stored in a Gaussian distribution , where is a hyperparameter used to reduce the standard deviation to prevent the reconstructed samples from deviating too much from the class center. When generating samples of old classes on a new task, only needs to be sampled from the corresponding class and the old model decoder is used to reconstruct the samples for joint training with new class samples to train a new model.

[0059] The knowledge distillation-based module uses a soft decision vector to learn the knowledge of the old model. The basic idea is that even negative labels contain a lot of information in the output of the Softmax layer. Therefore, in the embodiments of the present case, a corner boundary classification loss function as shown in equation (7) can be constructed using the knowledge distillation idea to transfer the knowledge of the old model to the new model.

[0060] (7)

[0061] where , are the VAE encoder and corner projection layer functions of the model on the old task; , are the VAE encoder and corner projection layer functions of the model on the new task; is the temperature coefficient; is the corresponding A-Softmax. And for the decision vector output by the new model, only the part of the class is intercepted, keeping the output dimension of the new and old models the same.

[0062] In summary, when there is a new task, the data required by the model only includes the network parameters of the old model, the training samples of the benign class and the small-sample malicious class, and the k normal distributions stored in the old VAE model. The storage cost and training time are greatly reduced, meeting the needs of incremental learning. Then the classification model on the new task is trained jointly with the reconstructed samples of the known malicious class (B), the new class samples, and the stored benign class (B) and small-sample malicious class (B) samples on the old task, and its loss function is shown in equation (8), corresponding to part ③ in : Figure 2

[0063] (8)

[0064] ​​wherein, 、 and are weight hyperparameters.

[0065] Finally, for the identification of unknown malicious classes, the identification of unknown classes can be realized by constructing and training EVT models, corresponding to the fourth part in Figure 2 . Similarly, when there is an updated identification task, the new model of this stage can become the old task model, and the iterative learning of the updated identification task starts again. Without using a large amount of training data on the original task, the malicious traffic of the newly added class can be quickly learned to meet the defense needs of various known and unknown threats in the network system.

[0066] Referring to Figure 3 , after the model is trained, when testing, the input sample can be first predicted by the classification model to obtain its classification label . If is a small sample malicious class, the classification result is ; if , the difference vector between the reconstructed sample of the input sample and the reconstructed sample of the latent feature class center is analyzed by the EVT model of the class to determine the probability of correct classification. If the probability is less than a threshold, the final identification result is an unknown malicious class ; otherwise, the classification result is still .

[0067] By combining the contrastive learning and the generation characteristics of the VAE model, the storage and extraction of old class knowledge are realized, the identification of new threats is quickly realized under the premise of ensuring detection efficiency, and the training cost and the risk of data poisoning attacks are reduced.

[0068] Further, based on the above model training method, the embodiment of the application further provides a fine-grained malicious traffic classification method based on contrastive incremental learning, comprising the following contents:

[0069] Based on the contrastive incremental learning and the variational autoencoder, a malicious traffic classification model is constructed, and the above model training method is used to train the malicious traffic classification model;

[0070] The target network traffic is monitored and collected, and the target network traffic data is input into the trained malicious traffic classification model, and the trained malicious traffic classification model is used to classify and identify the category of the target network traffic.

[0071] Based on the variational autoencoder, high-performance detection can be realized for benign classes, known malicious classes, small sample malicious classes and unknown malicious classes, and the identification of new classes can be realized without using a large number of old task samples, to adapt to the demand for storage cost and training time in the incremental learning scene. The combination of contrastive learning and variational autoencoder (VAE, Variational Auto-Encoder) classification is adopted, and A-Softmax is used to realize the identification of known classes and small sample classes; the reconstruction of VAE is combined with the extreme value theory (EVT), and the reconstruction error is used to realize the identification of unknown classes; the unique structure of VAE is used to store the knowledge of old classes, and the VAE reconstruction and knowledge distillation mechanism are used to retain the knowledge of old classes when learning new classes without a large number of old class samples.

[0072] Further, based on the above model training method, the embodiment of the present application also provides a fine-grained malicious traffic classification system based on contrastive incremental learning, comprising: a model construction module and a traffic identification module, wherein,

[0073] The model construction module is used to construct a malicious traffic classification model based on contrastive incremental learning and variational autoencoder, and train the malicious traffic classification model by using the above model training method;

[0074] The traffic identification module is used to monitor and collect target network traffic, and input the target network traffic data into the trained malicious traffic classification model, and use the trained malicious traffic classification model to classify and identify the category of the target network traffic.

[0075] Unless otherwise specified, the relative steps, numerical expressions and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0076] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between each embodiment can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the related parts can be referred to the method part.

[0077] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example are generally described in the above description. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation does not exceed the scope of the present application.

[0078] Those skilled in the art can understand that all or part of the steps in the above method can be instructed by programs to the related hardware, and the programs can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk or an optical disk. Alternatively, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software functional module. The present application is not limited to any specific form of combination of hardware and software.

[0079] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present application, which are used to illustrate the technical solutions of the present application, rather than limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can make modifications or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. Such modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A fine-grained malicious traffic classification method based on contrastive incremental learning, characterized in that, Includes the following content: A malicious traffic classification model is constructed based on contrastive incremental learning and variational autoencoders, and trained using a pre-defined model training method. The model training method includes: obtaining latent space features of sample data using the encoding network in the variational autoencoder; reconstructing sample data based on the decoding network in the variational autoencoder; constructing a variational autoencoder reconstruction loss based on the sample data and the reconstructed sample data; projecting the latent space features onto a hypersphere using an angular projection layer to obtain the hypersphere angular distance features corresponding to the sample data; classifying the angular distance features using a classifier; and constructing a classifier loss based on the classification output and existing labels of the sample data; constructing a total loss function for model training based on the reconstruction loss and the classifier loss, and introducing a contrastive learning loss based on the positive and negative feature spaces of the encoding network; and training the model based on the total loss function, where the total loss function L... All Represented as: L All =L vae +αL Ang +βL Cont Where α and β are weight hyperparameters, L vae L Ang L Cont Let L represent the reconstruction loss, classifier loss, and contrastive learning loss, respectively. Knowledge distillation is used to transfer network parameters, benign and malicious training samples, and the normal distribution of the variational autoencoder from the trained model. New class sample data are then combined to jointly construct a new model loss function, which is then used to jointly train a new classification model. The new model loss function L... All Represented as: L All =L vae +αL Ang +βL Cont +γL soft α, β, γ are weight hyperparameters, L vae L Ang L Cont L soft These represent the reconstruction loss, classifier loss, contrastive learning loss, and knowledge distillation soft decision vector learning loss, respectively. Monitor and collect target network traffic, and input the target network traffic data into a trained malicious traffic classification model. Use the trained malicious traffic classification model to classify and identify the category of target network traffic.

2. The fine-grained malicious traffic classification method based on contrastive incremental learning according to claim 1, characterized in that, The variational autoencoder reconstruction loss is constructed based on the mean squared error between the sample data and the reconstructed sample data. This includes: setting the posterior probability distribution of the latent space features to follow a Gaussian distribution, and using the mean squared error between the sample data and the reconstructed sample data to construct the reconstruction loss.

3. The fine-grained malicious traffic classification method based on contrastive incremental learning according to claim 1 or 2, characterized in that, It also includes: constructing a difference vector between sample data and reconstructing sample data to identify unknown malicious categories based on an extreme value theory model.

4. The fine-grained malicious traffic classification method based on contrastive incremental learning according to claim 1, characterized in that, In the classifier loss, the classifier loss is constructed based on the classification output and the existing labels of the sample data, and the A-Softmax function is used. The contrastive learning loss is represented by the InfoNCE loss.

5. A fine-grained malicious traffic classification system based on contrastive incremental learning, characterized in that, It includes: a model building module and a traffic identification module, wherein, The model building module is used to construct a malicious traffic classification model based on contrastive incremental learning and variational autoencoders, and to train the malicious traffic classification model using a preset model training method. The model training method includes: obtaining latent space features of sample data using the encoding network in the variational autoencoder; reconstructing sample data based on the decoding network in the variational autoencoder; constructing a variational autoencoder reconstruction loss based on the sample data and the reconstructed sample data; projecting the latent space features onto a hypersphere using an angular projection layer to obtain the hypersphere angular distance features corresponding to the sample data; classifying the angular distance features using a classifier; and constructing a classifier loss based on the classification output and existing labels of the sample data; constructing a total loss function for model training based on the reconstruction loss and the classifier loss, and introducing a contrastive learning loss based on the positive and negative feature spaces of the encoding network; and training the model based on the total loss function, where the total loss function L... All Represented as: L All =L vae +αL Ang +βL Cont Where α and β are weight hyperparameters, L vae L Ang L Cont Let L represent the reconstruction loss, classifier loss, and contrastive learning loss, respectively. Knowledge distillation is used to transfer network parameters, benign and malicious training samples, and the normal distribution of the variational autoencoder from the trained model. New class sample data are then combined to jointly construct a new model loss function, which is then used to jointly train a new classification model. The new model loss function L... All Represented as: L All =L vae +αL Ang +βL Cont +γL soft α, β, γ are weight hyperparameters, L vae L Ang L Cont L soft These represent the reconstruction loss, classifier loss, contrastive learning loss, and knowledge distillation soft decision vector learning loss, respectively. The traffic identification module is used to monitor and collect target network traffic, and input the target network traffic data into the trained malicious traffic classification model to classify and identify the category of target network traffic.

6. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is configured to execute a program stored in memory and, when the program is executed, implement the steps of the method described in claim 1.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in claim 1.

Images