5g slice traffic anomaly detection method and device, computer device and storage medium

Abstract

The application discloses a 5G slice flow anomaly detection method and device, computer equipment and storage medium, including: determining the slice type corresponding to each network device based on the characteristic parameters of each network device in the target 5G network; obtaining the flow table information corresponding to each type of slice type, and obtaining the traffic data and the statistical data corresponding to the traffic data based on the flow table information; based on the statistical data, the traffic data is processed into a picture to obtain a model training sample picture; based on the model training sample picture, a 5G slice flow anomaly detection model is trained; and based on the 5G slice flow anomaly detection model, the slice flow in the target 5G network is detected. Thus, the characteristics of the 5G network slice are used to determine the flow slice service, the service type carried is identified, and then the abnormal flow is determined based on the service type, thereby improving the accuracy of the abnormal flow determination.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the technical field of data detection, in particular to a 5G slice traffic anomaly detection method and device, computer equipment and storage medium. BACKGROUND

[0002] Massive network traffic is generated in 5G network every day, and the introduction of slice technology leads to highly dispersed and complex network traffic, so that the existing traffic detection method and system are difficult to detect and analyze the network traffic in real time and accurately; in addition, the large amount of data and high transmission speed in 5G network also increase the difficulty of monitoring and analysis, which leads to the lack of effective and fast detection method for 5G slice traffic in the existing method. SUMMARY

[0003] In view of this, in order to solve the above technical problems or part of the technical problems, the embodiment of the present application provides a 5G slice traffic anomaly detection method, device, computer equipment and storage medium.

[0004] In the first aspect, the embodiment of the present application provides a 5G slice traffic anomaly detection method, comprising:

[0005] Determine the slice type corresponding to each network device based on the feature parameters of each network device in the target 5G network;

[0006] Obtain the flow table information corresponding to each type of slice type, and obtain the traffic data and the statistical data corresponding to the traffic data based on the flow table information;

[0007] Picture processing is performed on the traffic data based on the statistical data, and a model training sample picture is obtained;

[0008] A 5G slice traffic anomaly detection model is trained based on the model training sample picture;

[0009] The slice traffic in the target 5G network is detected based on the 5G slice traffic anomaly detection model.

[0010] In one possible implementation, the method further comprises:

[0011] A neural network with an optimal weight function is trained by a glowworm swarm optimization algorithm;

[0012] The slice type of each network device is classified by the neural network based on the feature parameters of each network device in the target 5G network, and the slice type corresponding to each network device is determined.

[0013] In one possible implementation, the method further comprises:

[0014] acquire traffic data associated with each type of slice type based on the flow table information;

[0015] extract statistical data corresponding to the traffic data from the traffic data, wherein the statistical data at least includes source IP address, destination IP address, source port, destination port, protocol type, total packet number, total packet number, packet rate, packet arrival time interval and packet load.

[0016] In one possible implementation, the method further comprises:

[0017] convert the statistical data into a hexadecimal string value;

[0018] convert every two hexadecimal string values into a gray value to obtain a plurality of preset specification matrices;

[0019] convert each group of three of the plurality of preset specification matrices into an RGB format picture to obtain model training sample pictures.

[0020] In one possible implementation, the method further comprises:

[0021] label the model training sample pictures with normal traffic labels and abnormal traffic labels to obtain labeled model training sample pictures;

[0022] input the labeled model training sample pictures into a convolutional neural network for training, and when a preset training target is reached, acquire slice traffic picture recognition average time and abnormal recognition accuracy in the training process of the convolutional neural network;

[0023] train a 5G slice traffic anomaly detection model based on the slice traffic picture recognition average time and the abnormal recognition accuracy.

[0024] In one possible implementation, the method further comprises:

[0025] calculate a reward value based on the slice traffic picture recognition average time and the abnormal recognition accuracy;

[0026] acquire hyperparameters of the convolutional neural network and perform cyclic training on the convolutional neural network based on the hyperparameters and the reward value until the reward value or the number of cycles reaches a preset threshold, thereby obtaining a trained convolutional neural network;

[0027] use the trained convolutional neural network as a 5G slice traffic anomaly detection model.

[0028] In one possible implementation, the method further comprises:

[0029] acquire traffic data to be detected in the target 5G network;

[0030] perform picture processing on the traffic data to be detected to obtain slice traffic to be detected;

[0031] input the slice traffic to be detected into the 5G slice traffic anomaly detection model to perform anomaly detection on the slice traffic in the target 5G network.

[0032] In a second aspect, an embodiment of the present application provides a 5G slice traffic anomaly detection device, comprising:

[0033] A determination module is configured to determine a slice type corresponding to each network device based on a feature parameter of each network device in a target 5G network.

[0034] An acquisition module is configured to acquire flow table information corresponding to each type of slice type, and acquire traffic data and statistical data corresponding to the traffic data based on the flow table information.

[0035] A processing module is configured to perform picture processing on the traffic data based on the statistical data to obtain a model training sample picture.

[0036] A training module is configured to train a 5G slice traffic anomaly detection model based on the model training sample picture.

[0037] A detection module is configured to perform anomaly detection on slice traffic in the target 5G network based on the 5G slice traffic anomaly detection model.

[0038] Optionally, the determination module is further configured to train a neural network with an optimal weight function through a glowworm swarm optimization algorithm, and perform slice type classification for each network device through the neural network based on a feature parameter of each network device in the target 5G network to determine a slice type corresponding to each network device.

[0039] Optionally, the acquisition module is further configured to acquire traffic data associated with each type of slice type based on the flow table information, and extract statistical data corresponding to the traffic data from the traffic data, wherein the statistical data at least includes a source IP address, a destination IP address, a source port, a destination port, a protocol type, a total packet sending number, a total packet receiving number, a packet rate, a packet arrival time interval, and a packet load.

[0040] Optionally, the processing module is further configured to convert the statistical data into a hexadecimal string value, convert every two hexadecimal string values into a gray value to obtain a plurality of matrices of preset specifications, and convert every three matrices of the plurality of matrices of preset specifications into a picture in RGB format to obtain a model training sample picture.

[0041] Optionally, the training module is further configured to label the model training sample pictures with normal flow labels and abnormal flow labels to obtain labeled model training sample pictures, input the labeled model training sample pictures into a convolutional neural network for training, and obtain slice flow picture identification average time and abnormal identification accuracy in a training process of the convolutional neural network when a preset training target is reached; and train a 5G slice flow anomaly detection model based on the slice flow picture identification average time and the abnormal identification accuracy.

[0042] Optionally, the training module is further configured to calculate a reward value based on the slice flow picture identification average time and the abnormal identification accuracy, obtain hyperparameters of the convolutional neural network, and perform cyclic training on the convolutional neural network based on the hyperparameters and the reward value until the reward value or the number of cycles reaches a preset threshold, to obtain a trained convolutional neural network; and use the trained convolutional neural network as the 5G slice flow anomaly detection model.

[0043] Optionally, the detection module is further configured to obtain flow data to be detected in the target 5G network, perform picture processing on the flow data to be detected to obtain slice flow to be detected, input the slice flow to be detected into the 5G slice flow anomaly detection model, and perform anomaly detection on slice flow in the target 5G network.

[0044] In a third aspect, an embodiment of the present application provides a computer device, including a processor and a memory, the processor being configured to execute a 5G slice flow anomaly detection program stored in the memory to implement the 5G slice flow anomaly detection method in the first aspect.

[0045] In a fourth aspect, an embodiment of the present application provides a storage medium, including one or more programs stored in the storage medium, the one or more programs being executable by one or more processors to implement the 5G slice flow anomaly detection method in the first aspect.

[0046] The 5G slice traffic anomaly detection scheme provided by the embodiment of the application determines the slice type corresponding to each network device based on the characteristic parameters of each network device in the target 5G network; obtains the flow table information corresponding to each type of slice type, and obtains the traffic data and the statistical data corresponding to the traffic data based on the flow table information; performs picture processing on the traffic data based on the statistical data to obtain model training sample pictures; trains a 5G slice traffic anomaly detection model based on the model training sample pictures; and performs anomaly detection on the slice traffic in the target 5G network based on the 5G slice traffic anomaly detection model. Compared with the existing method which lacks an effective and rapid detection method for 5G slice traffic, the present scheme, in view of the characteristics of the 5G network slice, first performs traffic slice service judgment, identifies the service type carried, and then performs abnormal traffic judgment for the service type, thereby improving the accuracy of abnormal traffic judgment; through traffic picture processing, the complex one-dimensional characteristics of slice traffic are converted into two-dimensional characteristics, and the abnormal traffic abstraction behavior mode is concretized, facilitating the convolutional neural network to perform abnormal identification; in combination with the accuracy and delay of the model, the convolutional neural network hyperparameters are searched through the reinforcement learning algorithm, and finally a lightweight model capable of balancing the accuracy of abnormal identification and the complexity of network structure is trained. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 The architecture schematic diagram of the 5G slice traffic anomaly detection system provided by the embodiment of the application is shown in the figure;

[0048] Figure 2 The flow schematic diagram of the 5G slice traffic anomaly detection method provided by the embodiment of the application is shown in the figure;

[0049] Figure 3 The abnormal traffic picture schematic diagram provided by the embodiment of the application is shown in the figure;

[0050] Figure 4 The normal traffic picture schematic diagram provided by the embodiment of the application is shown in the figure;

[0051] Figure 5 The slice type identification flow schematic diagram based on the worm optimization algorithm provided by the embodiment of the application is shown in the figure;

[0052] Figure 6 The flow schematic diagram of another 5G slice traffic anomaly detection method based on reinforcement learning provided by the embodiment of the application is shown in the figure;

[0053] Figure 7 The structure schematic diagram of the 5G slice traffic anomaly detection device provided by the embodiment of the application is shown in the figure;

[0054] Figure 8 The structure schematic diagram of the computer device provided by the embodiment of the application is shown in the figure;

[0055] Figure 9 A schematic diagram of the weighting function provided in an embodiment of the present invention;

[0056] Figure 10 A schematic diagram of the hierarchical search space for the decomposition of neural structures provided in an embodiment of the present invention;

[0057] Figure 11 This is a schematic diagram illustrating the sampling of convolutional network structure parameters by a recurrent neural network controller provided in an embodiment of the present invention.

[0058] Figure 12 This is a schematic diagram of distributed training for neural structure search provided in an embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.

[0061] Figure 1 This is a schematic diagram of the architecture of the 5G slice traffic anomaly detection system provided in an embodiment of the present invention, as shown below. Figure 1 As shown, this 5G slice traffic anomaly detection system includes a slice flow table traffic acquisition module, a slice traffic feature extraction module, a traffic image generation module, and a monitoring model training module. The monitoring model training module includes a recurrent neural network controller, a convolutional neural network, and a feedback mechanism.

[0062] Slice flow table traffic acquisition module: Through software-defined networks, it obtains the flow table information and network slice identification information associated with each 5G slice instance.

[0063] Slice Traffic Feature Extraction Module: Uses traffic feature extraction tools to extract statistical data from traffic, such as source and destination IP addresses, source and destination ports, protocol type, total number of packets sent, total number of packets received, packet rate, packet arrival time interval, and packet load.

[0064] Traffic Image Conversion Module: Converts the traffic statistics output by the feature extraction module into images with three color channels and saves them.

[0065] The monitoring model training module comprises a recurrent neural network controller, a convolutional neural network, and a feedback device. The convolutional neural network is trained on pictures of normal traffic and abnormal traffic and corresponding labels to obtain two indexes of average time consumption for slice traffic picture identification and abnormal identification accuracy. The feedback device calculates a reward value according to the accuracy and the time consumption. The recurrent neural network accepts the reward value, trains hyperparameters of the convolutional neural network, including convolution type, convolution kernel size, jump layer connection mode, filter size, and convolution layer repetition number, and updates parameters of the controller using a gradient strategy algorithm, thereby obtaining new hyperparameters of the convolutional neural network in a new round, until an optimal model is output.

[0066] Figure 2 A flowchart of a 5G slice traffic anomaly detection method provided by an embodiment of the present application is shown in Figure 2 The method specifically comprises the following steps.

[0067] S21, determining a slice type corresponding to each network device based on feature parameters of each network device in a target 5G network.

[0068] In the embodiment of the present application, a neural network with an optimal weight function is trained by a glowworm swarm optimization algorithm; and a slice type classification is performed for each network device based on feature parameters of each network device in a target 5G network by the neural network, to determine a slice type corresponding to each network device.

[0069] Specifically, a slice type matched by each network device is identified based on feature parameters of each network device in a 5G network, and a weight function of the feature is continuously optimized according to an identification accuracy of the slice, to obtain a higher classification precision. In addition, a deep belief network and a neural network are used to perform optimal hybrid classification on the exact network slice, to further improve the accuracy of slice classification. The feature is re-adjusted and calculated using the obtained weight function, and the network slice type is predicted in the deep belief network and the neural network according to the newly extracted weight optimized feature. The results of the two are adjusted according to the weights of the deep belief network and the neural network, and the output results are merged through operation, to realize joint decision and obtain a prediction result of the device matched slice.

[0070] Specifically, the slice type identification process based on the glowworm swarm optimization algorithm is described in detail in combination with the flowchart of the slice type identification process based on the glowworm swarm optimization algorithm shown in Figure 5 and the flowchart of the 5G slice traffic anomaly detection method based on reinforcement learning shown in Figure 6

[0071] (1) Collect device connection feature parameters of 5G devices, as shown in Table 1 below.

[0072] Table 1 ​

[0073]

[0074] (2) The optimal weight function is found and output by the firefly swarm optimization algorithm, and the structure is as shown in Figure 9 The weight function can make the feature obtain a larger scale change, and let be the normalized feature, where n is the length of the feature, and the calculation formula of the weighted feature is:

[0075]

[0076] wherein, represents a new feature, represents a weight function for scaling the feature.

[0077] The accuracy of the hybrid classification will be used as the feedback value of the optimization algorithm. If the accuracy meets the expected requirement, the algorithm will stop optimization, and the weight function at this time will be used as the optimal weight function. Otherwise, the algorithm needs to continue optimization, and the new converged weight function is used to process the feature for subsequent hybrid classification.

[0078] Finally, in the slice classification stage, the obtained weight function is used to adjust and calculate the feature again, and the new extracted weight is used to optimize the feature. The type of network slice is predicted in the deep belief network and neural network, respectively. The results of the two are adjusted according to the above DBN and NN weights, and the output results are merged through AND operation to realize joint decision and obtain the final prediction result.

[0079] In summary, the overall steps of the model are as follows:

[0080] Step 1: Collect 5G network slice data on different devices, including slice identification, user equipment type, duration, packet loss rate, packet delay budget, bandwidth, speed, jitter, and modulation type.

[0081] Step 2: Perform the above preprocessing operations on the data, including missing data supplement, abnormal data correction, standardization, and other processing.

[0082] Step 3: Multiply the preprocessed data with the weight function, and input the product data into the deep belief network and neural network for hybrid classification training, respectively.

[0083] Step 4: Determine whether the recognition accuracy meets the predetermined target or maximum value. If the requirement is met, output the trained model and execute step 6, otherwise execute step 5.

[0084] Step 5: Optimize the weight function and network structure parameters through the swarm optimization algorithm to realize a new round of update and execute step 3.

[0085] Step 6: Output the trained model, use the model to identify the most matching slice, and if the slice type received by the device does not match, determine that the slice type is abnormal.

[0086] S22, obtain the flow table information corresponding to each type of slice, and obtain the traffic data and statistical data corresponding to the traffic data based on the flow table information.

[0087] (3) In combination with the slice type matched by the network device obtained above, a collection module is deployed in the software-defined network control layer of the 5G network key node (SDN controller, router, switch, etc.), the flow table information and network slice identification information associated with each 5G slice are collected through the REST API interface of the openflow switch model, and stored in the flow table set, and the normal traffic and abnormal traffic associated with the slice are obtained through the flow table information.

[0088] (4) The traffic feature extraction tool is used to parse the source and destination IP addresses, source and destination ports, protocol types, total packet sending number, total packet receiving number, packet rate, packet arrival time interval, and packet load from the traffic. The training data set uses the open source data set CICIDS2018, which includes 65000 device features and combined slice assignments collected from user equipment and network device control messages, and covers 50 attack modes, a total of 2748235 malicious traffic and 6584535 normal traffic can be used for training.

[0089] The collected data mainly includes the dimensions shown in Table 2:

[0090] Table 2

[0091]

[0092]

[0093] S23, based on the statistical data, the traffic data is processed into a picture to obtain a model training sample picture.

[0094] (5) In the flow feature, the features of continuous value variables are processed by quantization, and the features of discrete value variables are processed by one-hot encoding. In the process of converting flow features into pictures, two types of image datasets can be generated, which are converted into color pictures or grayscale pictures. Color picture set has three color channels, including red, green and blue, while grayscale picture set has only one channel. RGB image is a superimposed structure of three channel images, which will finally be converted into an array of MxNx3 pixels, where M and N are the number of columns and rows, respectively. Therefore, when the 100x100 pixels of the image are converted into grayscale and RGB, 100x100x1 images and 100x100x3 images will be generated, respectively. According to the experimental results, whether it is binary classification or multi-class classification, the accuracy of RGB image is higher than that of grayscale image, which shows higher performance. Therefore, the conversion of flow into RGB picture can improve the detection performance to some extent.

[0095] By converting the flow into a picture through flow picture, the collected statistical data is converted into a hexadecimal string value, and every two hexadecimal numbers are converted into a grayscale value and normalized to form a 100x100x3 matrix with three color channels. The matrix is saved as an RGB format picture. The output normal flow image has obvious regularity, while the abnormal flow appears more irregular and full of noise. As shown in the abnormal flow picture schematic diagram Figure 3 and the normal flow picture schematic diagram Figure 4 .

[0096] S24, training a 5G slice flow anomaly detection model based on the model training sample picture.

[0097] (6) The structure parameters of the convolutional neural network are trained using the framework of reinforcement learning, which mainly includes a recurrent neural network controller, a convolutional neural network trainer, and a feedback reward generator. The above converted picture is used as a model training sample picture, and the model training sample picture is labeled with normal flow label and abnormal flow label to obtain a labeled model training sample picture. The labeled model training sample picture is input into the convolutional neural network trainer for training to obtain the slice flow picture recognition average time LAT and the abnormal recognition accuracy ACC.

[0098] (7) The accuracy rate and delay balance coefficient w are taken as 0.7, and m represents the current model. The reward value of the feedback device is calculated by the following formula:

[0099]

[0100] (8) The recurrent neural network controller uses a hierarchical search space algorithm to search for convolutional neural network hyperparameters, divides the convolutional neural network into multiple blocks, searches for convolution types and connection methods for each block, and then repeatedly stacks the same unit, thereby simplifying the search space, and the search space of each block is mainly determined by the convolution type, the convolution kernel size, the pooling layer type, the number of filters, and the number of repetitions of each block convolution layer. The trainer will use these parameters to train the data set, and the classification result accuracy and time cost will be output to the feedback device.

[0101] A well-defined search space is extremely important for neural architecture search. A hierarchical search space is used, as shown in Figure 10 , which divides the CNN model into unique blocks, and then searches for the operation and connection of each block, thereby allowing different layer architectures to be used in different blocks. For hierarchical decomposition of the search space, network layers are grouped into a number of predefined skeletons called blocks according to their input resolution and filter size. Each block contains a variable number of repeated identical layers, but the layers of different blocks can be different. For each block, the operation and connection of individual layers are searched, and the number of layers is N, so the same layer is repeated N times. The CNN model can be divided into a series of predefined blocks, gradually reducing the input resolution and increasing the filter size. Each block has a list of identical layers, and the convolution operation and connection of these layers are determined by the sub-search space of each block. The sub-search space of each block is determined by the following parameters: convolution type, convolution kernel, skip layer connection method, output filter size, and number of layers in each block.

[0102] In a specific implementation, the recurrent neural network controller generates structure parameters of each block as a token sequence, predicts the convolution type, convolution kernel, skip layer connection method, output filter size, and layer repetition number within the block, as shown in Figure 11 , each prediction is classified by a softmax classifier, and then the process is repeated until the number of blocks exceeds a certain value. If the number of blocks exceeds a certain value, the process of generating the architecture will stop. Once the controller determines the parameters of each block and completes the generation of an architecture, a neural network with the architecture is established, and then the data is trained in the convolutional neural network trainer. When the model converges, the accuracy on the validation set is recorded for optimizing the parameters θ c of the controller to maximize the expected validation accuracy of the proposed architecture.

[0103] (9) A set of convolutional neural network hyperparameters and reward values are input into the recurrent neural network controller for training, and the controller parameters are updated using a gradient policy algorithm, thereby obtaining a new round of convolutional neural network hyperparameters, m represents the number of convolutional neural network hyperparameter sets, and θ c represents the structure parameters of the recurrent neural network.t R represents the hyperparameters of the current time convolutional neural network k Rk represents the reward value of the kth hyperparameter on the current validation set, and the hyperparameters of the new round of convolutional neural network are calculated by the following formula:

[0104]

[0105] Among them, the expected return is obtained by Monte Carlo method, and the policy parameters are updated by using event samples. The core is that the agent and the environment must complete a complete Episode interaction, and then the trajectory data obtained is used to calculate the future return G t , and the agent parameter theta is updated. The specific calculation and update process is as shown below.

[0106] Step 1: randomly initialize the policy parameter theta.

[0107] Step 2: in each Episode, according to the policy θ , the learning trajectory: s1, a1, r2, …, s T-1 , a T-1 , r T is obtained.

[0108] Step 3: for t = 1, 2, …, T, evaluate the return G t .

[0109] Step 4: update the policy parameter theta,

[0110] Step 5: according to the updated policy parameter theta, a new Episode is performed according to the new policy, and returns to step 2.

[0111] Step 6: repeat the above steps, and update theta through Episode until a cycle threshold is reached or the accuracy is improved by less than 0.001% compared with the last round, so as to obtain the optimal policy

[0112] (10) Repeat from (7), and when the reward value reaches the set threshold, exit the loop and output the convolutional neural network hyperparameters that balance the recognition efficiency and accuracy. The neural network is constructed by using the best convolutional neural network hyperparameters, and the neural network is trained until the model converges. Each time the gradient used to update the parameters of the controller corresponds to a sub-network training to convergence. However, because there are many sub-networks, and each time training converges, it takes a long time, so a distributed training and asynchronous parameter updating method is used to speed up the learning speed of the controller. The parameter server method is used in the embodiment of the present application, and there are S parameter servers in total, which are used to store the shared parameters of K controller copies. Each controller copy samples m parallel training different sub-architectures, and then the controller calculates the accuracy relative to thetac gradients and send them to the parameter server in order to update the weights of all controller replicas, as shown in Figure 12

[0113] S25, based on the 5G slice traffic anomaly detection model, performing anomaly detection on the slice traffic in the target 5G network.

[0114] (11) A neural network is constructed using the best convolutional neural network hyperparameters, and the CICIDS data is trained using the neural network until the model converges. After completing the work of neural network architecture search, the trained convolutional neural network (5G slice traffic anomaly detection model) needs to be used, and the result of the traffic picture is used as input to analyze and monitor network traffic in real time, classify abnormal sessions and normal sessions, and identify attacks such as DDoS, brute force FTP, brute force SSH, DoS, Heartbleed, web attack, penetration, botnet, etc.

[0115] The 5G slice traffic anomaly detection method provided by the embodiment of the application determines the slice type corresponding to each network device based on the feature parameters of each network device in the target 5G network; obtains flow table information corresponding to each type of slice type, and obtains traffic data and statistical data corresponding to the traffic data based on the flow table information; the traffic data is processed by picture based on the statistical data, and a model training sample picture is obtained; a 5G slice traffic anomaly detection model is trained based on the model training sample picture; and the slice traffic in the target 5G network is detected based on the 5G slice traffic anomaly detection model. Compared with the existing method which lacks an effective and fast detection method for 5G slice traffic, according to the method, the characteristics of the 5G network slice are considered, the traffic slice service is first judged, the type of the service carried is identified, and then the abnormal traffic is judged, so that the accuracy of the abnormal traffic judgment is improved; through traffic picture, the complex one-dimensional feature of the slice traffic is converted into a two-dimensional feature, the abnormal traffic is abstracted into a specific behavior mode, and the convolutional neural network is convenient for abnormal identification; in combination with the accuracy and delay of the model, the convolutional neural network hyperparameters are searched through the reinforcement learning algorithm, and finally a lightweight model capable of balancing the accuracy of abnormal identification and the complexity of the network structure is trained.

[0116] Figure 7 A structure schematic diagram of a 5G slice traffic anomaly detection device according to an embodiment of the application is shown in FIG. 1. Figure 7 As shown in FIG. 1, the device comprises:

[0117] The determination module 701 is configured to determine the slice type corresponding to each network device based on the feature parameters of each network device in the target 5G network. For details, refer to the related description of the corresponding method embodiment described above, which will not be repeated here.​

[0118] The acquisition module 702 is configured to acquire flow table information corresponding to each type of slice type, and acquire traffic data and statistical data corresponding to the traffic data based on the flow table information. For details, refer to the related description of the method embodiments.

[0119] The processing module 703 is configured to perform picture processing on the traffic data based on the statistical data to obtain model training sample pictures. For details, refer to the related description of the method embodiments.

[0120] The training module 704 is configured to train a 5G slice traffic anomaly detection model based on the model training sample pictures. For details, refer to the related description of the method embodiments.

[0121] The detection module 705 is configured to perform anomaly detection on slice traffic in the target 5G network based on the 5G slice traffic anomaly detection model. For details, refer to the related description of the method embodiments.

[0122] The 5G slice traffic anomaly detection device provided by the embodiments of the present application is used to execute the 5G slice traffic anomaly detection method provided by the above embodiments, and the implementation manner and principles are the same. For details, refer to the related description of the method embodiments.

[0123] Figure 8 A computer device according to an embodiment of the present application is shown in FIG. 8. Figure 8 As shown in FIG. 8, the computer device can include a processor 801 and a memory 802, wherein the processor 801 and the memory 802 can be connected through a bus or other means, Figure 8 For example, the bus connection.

[0124] The processor 801 can be a central processing unit (CPU). The processor 801 can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, or combinations thereof.

[0125] The memory 802, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the method provided in the embodiments of the present application. The processor 801 performs various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 802, that is, implements the method in the above-mentioned method embodiments.

[0126] The memory 802 can include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function; and the data storage area can store data created by the processor 801 and the like. In addition, the memory 802 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 802 can optionally include a memory disposed remotely with respect to the processor 801, and these remote memories can be connected to the processor 801 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0127] One or more modules are stored in the memory 802, and when executed by the processor 801, the method in the above-mentioned method embodiments is performed.

[0128] The above-mentioned computer device specific details can be understood by referring to the corresponding related description and effects in the above-mentioned method embodiments, which will not be described here.

[0129] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The program can be stored in a computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD), etc. The storage medium can also include a combination of the above-mentioned types of memories.

[0130] Although the embodiments of the present application are described in conjunction with the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A method for detecting abnormal traffic in 5G video slices, characterized in that, include: Train a neural network with the optimal weight function using the firefly swarm optimization algorithm; Based on the characteristic parameters of each network device in the target 5G network, a deep belief network and the neural network are used to classify the slice type of each network device to determine the slice type corresponding to each network device; wherein, the characteristic parameters include slice identifier NSSAI, packet delay budget, bandwidth, jitter, session connection duration and modulation type; Obtain the flow table information corresponding to each slice type, and obtain the traffic data and the statistical data corresponding to the traffic data based on the flow table information; Based on the statistical data, the traffic data is processed into images to obtain model training sample images; wherein, the process of processing the traffic data into images based on the statistical data to obtain model training sample images includes: The statistical data is converted into hexadecimal string values, and each two digits are converted into a grayscale value and normalized to obtain multiple preset specification matrices. Each group consists of three matrices, corresponding to the red, green, and blue channels of an RGB format image, which are then combined and converted into an RGB format image to obtain the model training sample images. A 5G slice traffic anomaly detection model is trained based on the model training sample images; The 5G slice traffic anomaly detection model is used to detect anomalies in the slice traffic of the target 5G network.

2. The method according to claim 1, characterized in that, The step of obtaining traffic data and corresponding statistical data based on the flow table information includes: Based on the flow table information, obtain the flow data associated with each slice type; Extract statistical data corresponding to the traffic data from the traffic data, wherein the statistical data includes at least the source IP address, destination IP address, source port, destination port, protocol type, total number of packets sent, total number of packets received, packet rate, packet arrival time interval, and packet load.

3. The method according to claim 1, characterized in that, The training of the 5G slice traffic anomaly detection model based on the model training sample images includes: The training sample images of the model are labeled with normal traffic labels and abnormal traffic labels to obtain labeled training sample images of the model; The labeled model training sample images are input into the convolutional neural network for training. When the preset training target is reached, the average time consumption and anomaly recognition accuracy of the convolutional neural network during the training process are obtained. A 5G slice traffic anomaly detection model was trained based on the average time spent on slice traffic image recognition and the anomaly recognition accuracy.

4. The method according to claim 3, characterized in that, The 5G slice traffic anomaly detection model, trained based on the average time spent on slice traffic image recognition and the anomaly recognition accuracy, includes: The reward value is calculated based on the average time spent on the sliced ​​traffic image recognition and the anomaly recognition accuracy. The hyperparameters of the convolutional neural network are obtained, and the convolutional neural network is trained iteratively based on the hyperparameters and the reward value until the reward value or the number of iterations reaches a preset threshold, thus obtaining a trained convolutional neural network. The trained convolutional neural network was used as a 5G slice traffic anomaly detection model.

5. The method according to claim 4, characterized in that, The anomaly detection of slice traffic in the target 5G network based on the 5G slice traffic anomaly detection model includes: Acquire the traffic data to be detected in the target 5G network; The traffic data to be detected is processed into images to obtain the traffic slices to be detected; The slice traffic to be detected is input into the 5G slice traffic anomaly detection model to perform anomaly detection on the slice traffic in the target 5G network.

6. A 5G slice traffic anomaly detection device, characterized in that, include: A module is defined for training a neural network with the optimal weight function using the firefly swarm optimization algorithm; Based on the characteristic parameters of each network device in the target 5G network, a deep belief network and the neural network are used to classify the slice type of each network device to determine the slice type corresponding to each network device; wherein, the characteristic parameters include slice identifier NSSAI, packet delay budget, bandwidth, jitter, session connection duration and modulation type; The acquisition module is used to acquire the flow table information corresponding to each slice type, and to acquire the traffic data and the statistical data corresponding to the traffic data based on the flow table information; The processing module is used to process the traffic data into images based on the statistical data to obtain model training sample images; wherein, the processing module includes: converting the statistical data into hexadecimal string values, converting every two digits into a grayscale value and normalizing it to obtain multiple preset specification matrices; every three matrices are grouped together, corresponding to the red, green and blue channels of the RGB format image respectively, and combined to convert them into RGB format images to obtain model training sample images; The training module is used to train a 5G slice traffic anomaly detection model based on the model training sample images; The detection module is used to detect anomalies in the slice traffic of the target 5G network based on the 5G slice traffic anomaly detection model.

7. The apparatus according to claim 6, characterized in that, The acquisition module is further configured to acquire traffic data associated with each slice type based on the flow table information; extract statistical data corresponding to the traffic data from the traffic data, wherein the statistical data includes at least the source IP address, destination IP address, source port, destination port, protocol type, total number of packets sent, total number of packets received, packet rate, packet arrival time interval, and packet load.

8. The apparatus according to claim 6, characterized in that, The training module is also used to label the model training sample images with normal traffic labels and abnormal traffic labels to obtain labeled model training sample images; input the labeled model training sample images into the convolutional neural network for training; and when the preset training target is reached, obtain the average time consumption and anomaly recognition accuracy of the convolutional neural network in the training process of slice traffic image recognition. A 5G slice traffic anomaly detection model was trained based on the average time spent on slice traffic image recognition and the anomaly recognition accuracy.

9. The apparatus according to claim 8, characterized in that, The training module is also used to calculate a reward value based on the average time spent recognizing the slice traffic images and the accuracy of anomaly recognition; to obtain the hyperparameters of the convolutional neural network and to perform iterative training on the convolutional neural network based on the hyperparameters and the reward value until the reward value or the number of iterations reaches a preset threshold, thereby obtaining a trained convolutional neural network; and to use the trained convolutional neural network as a 5G slice traffic anomaly detection model.

10. The apparatus according to claim 9, characterized in that, The detection module is further configured to acquire traffic data to be detected in the target 5G network; process the traffic data to be detected into images to obtain the slice traffic to be detected; and input the slice traffic to be detected into the 5G slice traffic anomaly detection model to perform anomaly detection on the slice traffic in the target 5G network.

11. A computer device, characterized in that, include: A processor and a memory, the processor being configured to execute a 5G slice traffic anomaly detection program stored in the memory to implement the 5G slice traffic anomaly detection method according to any one of claims 1 to 5.

12. A storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the 5G slice traffic anomaly detection method according to any one of claims 1 to 5.

Images