A Classification Method for Unknown Network Protocols Based on Few-Shot Learning

Abstract

The present invention provides a method for classifying unknown network protocols based on few-shot learning. The specific steps include: In the first part, pure single-protocol original network traffic is collected. After shunting processing, partial packet headers and a small part of the payloads at the initial stage of communication for each flow are visualized into RGB images, and a pure visualized protocol traffic dataset is constructed. In the second part, a task set required for the "N-way K-shot" classification problem in the meta-training and meta-testing stages of the few-shot protocol model is constructed. In the third part, the task set is input into a neural network, and a meta-learning model with prior knowledge of protocol traffic classification is obtained through meta-training. In the meta-testing stage, the model is fine-tuned with new tasks composed of a small number of unknown protocols to obtain a classification model applicable to unknown protocols. In the fourth part, for unknown protocol recognition, the traffic to be measured is preprocessed to generate an image and then input into the few-shot unknown protocol recognition model to output the final prediction result.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security and relates to a method for classifying unknown network protocols based on few-shot learning. Background Art

[0002] Network protocols are an important link in Internet communication and are a collection of rules, standards or agreements for data exchange in computer networks. With the rapid development of current Internet technology, network traffic data has grown explosively, and network protocols have become increasingly complex. The identification and analysis of network protocols are the basis of network security and the premise of network traffic analysis, directly affecting network intrusion detection, traffic monitoring, and user behavior analysis, etc., and are of great significance for network supervision and anomaly detection. In addition to widely used protocols such as FTP and HTTP, more and more dedicated and private protocol traffic brings great challenges to Internet security. The research on known protocols has been very mature, and the research focus of protocol identification has gradually shifted to the identification of unknown protocols. However, the research on unknown protocol identification is still in its infancy, and the key lies in the feasibility, accuracy, and identification efficiency of unknown protocol analysis. However, the amount of data samples available for analysis of newly emerging protocols is often very scarce. Therefore, in order to maintain network security, how to efficiently and accurately identify unknown network protocols with a very small amount of samples has become a hot issue.

[0003] The methods for protocol identification mainly include port-based traffic identification, deep packet inspection (DPI)-based traffic identification, and machine learning- and deep learning-based traffic identification. These methods all identify protocols based on a large amount of prior knowledge. At present, port disguise technology or dynamic port technology has almost eliminated the method of protocol identification based on traditional port detection technology. The deep packet inspection technology has a high accuracy rate only for specific protocols but has a low operating efficiency. The accuracy rate of protocol identification based on machine learning methods largely depends on the training sample size and feature engineering, and at the same time, the generality of the model is low.

[0004] Currently, the analysis for unknown protocol analysis is mainly divided into two types: network traffic and behavior traces. Behavior-based protocol analysis depends on reverse analysis of the execution instruction traces of the communication source program. The analysis method based on network traffic focuses on data packets, has stronger generality, does not depend on a specific platform implementation, and has higher analysis efficiency. Therefore, the present invention adopts a method based on network traffic.

[0005] The main difficulties in the research on unknown protocols compared with the research on traditional known protocols are: (1) The number of protocol traffic samples available for unknown protocols such as proprietary or private ones is at a small order of magnitude, and it is difficult to solve the overfitting problem of traditional methods; (2) It is difficult to balance the accuracy rate and efficiency of current algorithms; (3) The current models have poor generality and low generalization ability.

[0006] Therefore, in order to accurately and efficiently identify unknown protocols in a small-sample scenario, the present invention visualizes the original network traffic as RGB images, automatically extracts the overall features of the protocols through inputting into a CNN neural network, and learns the ability of protocol classification through a small-sample multi-task model. Summary of the Invention

[0007] In order to maintain the security of the cyber space and achieve the identification of unknown protocols in a few-shot scenario, the present invention proposes a small-sample unknown protocol classification model. The first part collects pure single-protocol original network traffic, visualizes it into RGB images, and constructs a pure visualized traffic data set. The second part constructs the task sets required for the "N-way K-shot" classification problems in the meta-training and meta-testing stages of the small-sample protocol model. The third part inputs the task sets into a neural network, obtains a meta-model with prior knowledge through meta-training, and fine-tunes the model with a small number of new tasks containing unknown protocol categories in the meta-testing stage to obtain a small-sample protocol classification model applicable to new tasks. The fourth part is for unknown protocol identification. The traffic to be measured is preprocessed to generate images, then a task set is constructed, and it is input into the small-sample unknown protocol identification model to output the final test results.

[0008] In order to achieve the above object, the present invention provides the following technical solutions:

[0009] (1) Collect pure single-protocol original network traffic;

[0010] (2) Visualize it into RGB images and construct a pure visualized traffic data set;

[0011] (3) Construct the task sets required for the "N-way K-shot" classification problems in the meta-training and meta-testing stages;

[0012] (4) Input the task sets into a neural network, obtain a meta-learning model with prior knowledge of protocol traffic classification through meta-training, and fine-tune the model with a small number of new tasks composed of unknown protocols in the meta-testing stage to obtain a classification model applicable to unknown protocols;

[0013] (5) Preprocess the traffic to be measured to generate images, then input it into the small-sample unknown protocol identification model and output the final prediction results.

[0014] Furthermore, the step (1) specifically includes the following sub-steps:

[0015] (1.1) Collect raw network traffic data in PCAP format, and use the wireshark tool to label the corresponding protocol tags for common known network protocols according to the port numbers; for protocol traffic beyond the capabilities of the tool, add the corresponding tags by strictly restricting the self-collected traffic in a single-protocol environment and manually.

[0016] (1.2) Split the network traffic according to the five-tuple (source IP address, source port, destination IP address, destination port, protocol type);

[0017] (1.3) Randomize the MAC, port number, and IP in the dataset to anonymize the data stream;

[0018] Furthermore, the step (2) specifically includes the following sub-steps:

[0019] (2.1) Select the first M (M is a multiple of 3) data packets of each data stream processed in step (1). The data packets within the data stream are arranged in chronological order. Generally, the initially transmitted data packets contain the majority of protocol features, and the subsequent discarded data packets are continuous content transmissions. When M takes an appropriate value, it can include the connection establishment process and a small amount of content transmission.

[0020] (2.2) Take the first N (N is a perfect square) bytes of each data packet in step (2.1) to represent the overall information. When N takes an appropriate value, it can completely contain the header of the data packet and a part of the payload information.

[0021] (2.3) Fill the insufficient parts in steps (2.1) and (2.3) with 0x00.

[0022] (2.4) Arrange every N bytes of the normalized data packets in step (2.3) into a matrix, and the possible values of each element correspond to grayscale, thus obtaining a grayscale image with a size of ;

[0023] (2.5) Take the adjacent three grayscale images in step (2.4) as the inputs of the R, G, and B channels of the color image respectively. Finally, each data stream can obtain M / 3 color images. Complete the image visualization of the network traffic.

[0024] Furthermore, the step (3) specifically includes the following sub-steps:

[0025] (3.1) Divide the 9 types of protocols with known working principles and protocol formats in the generated visualization protocol dataset into the known protocol set D known , and define the other 4 types of protocols with a small sample size as unknown protocols, which are classified into the unknown protocol set D unknown .

[0026] (3.2) Randomly select N types (N-way) from the dataset, and randomly select (K + m) instances (m ≥ 1) for each type. The N*(K + m) instances form the dataset of the current task T i . Among them, N*K instances are used as the sample set

[0027] S = {(x1, y1), (x2, y2), ···, (x n , y n )}

[0028] where x i ∈R d , y i ∈ {0, 1, ……, N}, and the remaining N * m instances are used as the query set Q i . Thus, a few - shot task T i = {S i , Q i , K}.

[0029] (3.3) Repeat the operation steps in (3.2) to construct a meta - training task set T known containing multiple sub - tasks from the data set D train = {T1, T2, ……, T n [[ID=3|]]}.

[0030] (3.4) Similarly, repeat the operations in step (3.2) on the unknown - protocol data set D unknown to construct a meta - testing task set T test = {T1, T2, ……, T B}, where B is a relatively small value.

[0031] Furthermore, step (4) specifically includes the following sub - steps:

[0032] (4.1) Randomly select n tasks from the meta - training task set as a batch, and initialize the base learner f with random parameters θ , set the learning rates of the base learner and the meta - learner to be α and β respectively, and select the cross - entropy function MSE as the loss function.

[0033] (4.2) The loss function on the support set S i of each task T i in this batch is Update the base learner using gradient descent. The target parameter After K - sample training iterations, the parameter is updated as:

[0034]

[0035] On this basis, use the test set Q i to conduct tests, and calculate the loss function of the current task under this parameter

[0036] (4.3) Repeat the above operation steps (4.2) until the task training of this batch is completed, integrate the loss functions of different sub-tasks, and update the meta-learner.

[0037]

[0038] (4.4) Loop through steps (4.1) to (4.3) until the objective function converges.

[0039]

[0040] Thus, obtain the globally optimal hyperparameters with prior knowledge of the protocol traffic classification task.

[0041] (4.5) In the meta-testing phase, Initialize the network parameters to avoid cold start, use T test Train and fine-tune the model using gradient descent to obtain a classification model f(θ * ) suitable for unknown protocols, and test the performance of the current model using the test set.

[0042] Furthermore, the step (5) specifically includes the following sub-steps:

[0043] (5.1) Set different "N-way K-shot" tasks in step 5 to obtain the corresponding classifier f(θ * ) suitable for few-shot unknown protocols. Modify the model according to the principle of error-correcting output codes, use multiple classifiers to predict the test samples respectively, and these prediction labels form a code. Compare this prediction code with the respective codes of each class, and return the class with the smallest distance as the final prediction result.

[0044] (5.2) Input the traffic to be measured into the modified classifier after generating an image through step (3), and output the final predicted protocol category.

[0045] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0046] (1) The present invention can quickly and accurately identify unknown protocol categories without extracting features by expert experience, and uses the representation ability of deep neural networks and meta-learning algorithms to accurately identify protocols.

[0047] (2) Based on the meta-learning algorithm, the present invention solves the problem of overfitting in traditional machine learning and has a faster model convergence speed for classifying unknown protocols in few-shot scenarios.

[0048] (3) The present invention can also achieve a high recognition accuracy without using a large number of target protocol samples, and thus can identify unknown protocols at an early stage. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The present invention provides an unknown network protocol classification framework based on small sample learning.

[0050] Figure 2 Flowchart for visualizing protocol traffic.

[0051] Figure 3 Neural networks for unknown protocol classification based on few-shot learning.

[0052] Figure 4 is the accuracy of the meta-test phase using the 2way-10shot task.

[0053] Figure 5 Visualize the results for protocol traffic. DETAILED DESCRIPTION

[0054] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0055] Example 1: The present invention provides a method for classifying unknown network protocols based on small sample learning, and the specific steps include: the first part collects pure single-protocol original network traffic, visualizes it into RGB images, and constructs a pure visualized protocol traffic data set. The second part constructs the task set required for the "N-way K-shot" classification problem of the small sample protocol model in the meta-training and meta-testing stages. The third part inputs the task set into the neural network, obtains a meta-learning model with prior knowledge of protocol traffic classification through meta-training, and fine-tunes the model through new tasks composed of a small number of unknown protocols in the meta-testing stage to obtain a classification model suitable for unknown protocols. The fourth part is the identification of unknown protocols, which pre-processes the traffic to be tested to generate an image and then inputs it into the small sample unknown protocol identification model to output the final prediction result.

[0056] Specifically, the inventive method comprises the following steps:

[0057] (1) Collecting pure single-protocol raw network traffic. The specific process of this step is to use the Wireshark tool to collect raw network traffic data in PCAP format and label common known network protocols according to the port number. For protocol traffic beyond the tool's capabilities, we strictly limit the single-protocol environment to self-collected traffic and manually add corresponding labels. Then, we divert and anonymize the traffic.

[0058] (2) Visualize and process the data into RGB images to build a pure visualization traffic data set. The specific process of this step is as follows:

[0059] (2.1) Select the first 15 data packets of each data stream. The subsequent discarded packets are for continuous content transmission. Pad with 0x00 when insufficient.

[0060] (2.2) Select the first 256 bytes of each data packet. Pad the insufficient part with 0x00. Arrange the bytes into a 16×16 matrix, and the possible values of each element correspond to grayscale, thus obtaining a grayscale image of size 16×16.

[0061] (2.3) Use the three adjacent grayscale images generated in step (2.2) as the inputs for the R, G, and B channels of the color image respectively. Finally, 5 color images can be obtained for each data stream and labeled with the same label as the data stream. Complete the image visualization of network traffic. The visualization results are as Figure 5 shown.

[0062] (3) Construct the task sets required for the "N-way K-shot" classification problems in the meta-training and meta-testing phases. The specific process of this step is as follows: Divide the protocol data set into a known protocol set D known and an unknown protocol set D unknown . Specifically, as shown in Table 1.

[0063] Table 1 Protocol Data Set

[0064]

[0065] Randomly select N types in the data set, and randomly extract (K + m) instances (m ≥ 1) for each type. The N*(K + m) instances form the data set of the current task T i . Among them, N*K instances are used as the sample set, and the remaining (N*m) instances are used as the query set Q i . Thus, a few-shot task T i ={S i , Q i , K} is formed. Repeat the operation from the data set D known to construct a meta-training task set T train ={T1, T2,..., T n}. Similarly, construct a meta-testing task set T unknown ={T1, T2,..., T test} containing B sub-tasks from D B . Set N to 2 and 4, and set K to 5, 10, and 15 respectively for construction, and m is fixed at 5.

[0066] (4) Input the task set into the neural network, obtain a meta-learning model with prior knowledge of protocol traffic classification through meta-training, and fine-tune the model with a few new tasks composed of unknown protocols in the meta-testing phase to obtain a classification model applicable to unknown protocols. The specific process of this step is as follows: In the meta-training phase, input Ttrain Substitute in multiple batches into the network to train the globally optimal hyperparameters with prior knowledge of protocol classification In the meta-testing stage, through a small number of test task sets T test Train a model suitable for classifying new tasks of unknown protocols, and save the model. Taking N = 2, K = 10 as an example, the convergence process is as Figure 2 shown.

[0067] The neural network structure used in this step is that Block 1 consists of 4 layers: "conv2d, 3×3, 3, 64" represents a two-dimensional convolutional layer, the size of the convolutional kernel is 3×3, 3 input channels, and 64 output channels; "relu" represents an activation layer using Relu as the activation function; "bn, 64" represents a batch normalization layer with 64 channels; "max_pool2d, 2, 2" represents a max pooling layer with a window size of 2 and a sliding stride of 2. Block 2 also consists of 4 layers: "conv2d, 3×3, 64, 64" represents a two-dimensional convolutional layer, the size of the convolutional kernel is 3×3, 64 input channels, and 64 output channels, and the meanings of the remaining components are the same as those of Block1. Block 3 also consists of 4 layers: "max_pool2d, 2, 1" represents a max pooling layer with a window size of 2 and a sliding stride of 2, and the meanings of the remaining components are the same as those of Block 2. Block 4 consists of 2 layers: "Flatten" is used to one-dimensionalize multi-dimensional inputs; "Linear" represents a fully connected layer that maps the abstract features of the image to the classification results of the image.

[0068] (5) Preprocess the traffic to be measured to generate an image, then input it into the few-shot unknown protocol recognition model and output the final prediction result. The specific process of this step is as follows

[0069] (5.1) When N = 2, obtain multiple classifiers f(θ * ), for example it can distinguish unknown protocol A and unknown protocol B, it can well distinguish unknown protocol C and unknown protocol D. Use multiple classifiers to predict the test samples respectively, and these prediction labels form a code. Compare this prediction code with the respective codes of each category, and return the category with the smallest distance as the result. Similarly, make a similar transformation when N = 4.

[0070] (5.2) Generate an image from the traffic to be measured, then input it into the transformed classifier, and output the final predicted protocol category. The classification effect for 4 types of unknown protocols is shown in Table 2

[0071] Table 2 Classification accuracy of few-shot unknown protocols

[0072]

[0073]

[0074] The technical means disclosed by the solution of the present invention are not limited to the technical means disclosed in the above embodiments, and also include technical solutions composed of any combination of the above technical features. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements are also regarded as the protection scope of the present invention.

Claims

1. A method for classifying unknown network protocols based on small sample learning, characterized in that: The steps include: (1) Collect pure single-protocol raw network traffic; (2) Visualization processing into RGB images to build a pure visualization traffic data set; (3) Construct the task set required for the "N-way K-shot" classification problem in the meta-training and meta-testing stages; (4) The task set is input into the neural network, and a meta-learning model with prior knowledge of protocol traffic classification is obtained through meta-training. In the meta-testing phase, the model is fine-tuned by a small number of new tasks consisting of unknown protocols to obtain a classification model suitable for unknown protocols; (5) Preprocessing the traffic to be tested to generate an image and input it into the small sample unknown protocol recognition model to output the final prediction result; Step (1) collects pure single-protocol original network traffic; specifically includes the following sub-steps: (1.1) Collect raw network traffic data in PCAP format and use the Wireshark tool to label common known network protocols according to their port numbers. For protocol traffic beyond the tool's capabilities, strictly limit the collected traffic to a single protocol environment and manually add corresponding labels. (1.2) Network traffic is divided into five groups, each of which includes the source IP address, source port, destination IP address, destination port, and protocol type. (1.3) Randomize the MAC, port number, and IP in the data set to achieve data flow anonymization. Step (2) Generate a visual protocol traffic data set; specifically, it includes the following sub-steps: (2.1) Select the first M packets of each data stream after processing in step (1), where M is a multiple of 3; the packets in the data stream are arranged in chronological order, the first transmitted packets contain most of the protocol features, and the subsequently discarded packets are continuous content transmissions; when M is taken as an appropriate value, it can include the connection establishment process and a small amount of content transmission; (2.2) Take the first N bytes of each data packet in step (2.1) to represent the entire information, where N is a square number; when N takes an appropriate value, it can completely contain the header of the data packet and part of the payload information; (2.3) Fill the missing parts of steps (2.1) and (2.3) with 0x00; (2.4) Arrange the first N bytes of the data packet normalized in step (2.3) as The matrix of , each element's possible value corresponds to the grayscale, so that the size is Grayscale image of (2.5) The three adjacent grayscale images from step (2.4) are used as the inputs of the R, G, and B channels of the color image, respectively. Ultimately, each data stream can obtain M / 3 color images, completing the image visualization of network traffic.

2. The unknown network protocol classification method based on small sample learning according to claim 1 is characterized in that: Step (3) constructs the task set required for the "N-way K-shot" classification problem in the meta-training and meta-testing phases; specifically, it includes the following sub-steps: (3.1) Divide the 9 types of protocols whose working principles and protocol formats are already well known in the visualization protocol dataset generated in step (2) into the known protocol set D known In addition, the four types of protocols with a small number of samples are defined as unknown protocols and classified into the unknown protocol set D unknown ; (3.2) In the known data set D known Randomly extract N types (N-way), randomly extract (K+m) instances (m≥1) of each type, and these N*(K+m) instances constitute the current task T i A dataset of N*K instances as sample set S={(x1,y1),(x2,y2),···,(x n ,y n )} where x i ∈R d ,y i ∈{0, 1, ..., N}, the remaining N*m instances are the query set Q i ; Thus forming a small sample task T i ={S i ,Q i ,K}; (3.3) From the dataset D known Repeat step (3.2) to construct a meta-training task set T containing multiple subtasks train ={T1, T2, ..., T n }; (3.4) Similarly, in the unknown protocol dataset D unknown Repeat step (3.2) to construct a meta-test task set T containing B subtasks test ={t1, t2, ..., t B }, where B is a smaller value.

3. The unknown network protocol classification method based on small sample learning according to claim 1 is characterized in that: Step (4) inputs the task set into the neural network, obtains a meta-learning model with prior knowledge of protocol traffic classification through meta-training, and fine-tunes the model through new tasks consisting of a small number of unknown protocols in the meta-testing phase to obtain a classification model suitable for unknown protocols; specifically, it includes the following sub-steps: (4.1) From the meta-training task set T train Randomly select n tasks as a batch, with random parameters Initialize the base learner fθ, set the learning rates of the base learner and meta learner to α and β respectively, and select the cross entropy function MSE as the loss function; (4.2) Each task T in this batch i The support set S i The loss function on Update the base learner using gradient descent; target parameters After training iterations of K samples, the parameters are updated as follows: On this basis, we use the test set Q i Perform the test and calculate the loss function under the parameters of the current task (4.3) Repeat the above steps (4.2) until the training of this batch of tasks is completed, integrate the loss functions of different subtasks and update the meta-learner. (4.4) Repeat steps (4.1) to (4.3) until the objective function converges. Thus, the global optimal hyperparameters with prior knowledge of the protocol traffic classification task are obtained (4.5) In the meta-test phase, Initialize network parameters to avoid cold start, use T test Train and use gradient descent to fine-tune the model to obtain a classification model f(θ * ), the test set verifies the performance of the current model.

4. The method for classifying unknown network protocols based on small sample learning according to claim 1, characterized in that: Step (5) pre-processes the traffic to be measured to generate an image, which is then input into the small sample unknown protocol recognition model and outputs the final prediction result; specifically, it includes the following sub-steps: (5.1) Set different "N-way K-shot" tasks in step 5 to obtain the corresponding classifier f(θ * ); Based on the principle of error-correcting output codes, the model is modified and predictions are made for each test sample. These prediction labels form a code; this predicted code is compared with the code of each category, and the category with the smallest distance is returned as the final prediction result; (5.2) The image of the traffic to be tested is generated in step (3) and then input into the modified classifier, and the final predicted protocol category is output.

Images