A malicious traffic detection method, system, device and storage medium

Abstract

The application discloses a malicious traffic detection method, system and device and a storage medium, and belongs to the technical field of network traffic analysis and cyberspace security application, and the method comprises the following steps: obtaining traffic statistical information to be detected, and performing format preprocessing on the traffic statistical information to obtain a sample vector; inputting the sample vector into a pre-trained neural network partial framework search network model to obtain a prediction vector; the prediction vector comprises a plurality of prediction values, each prediction value comprises a classification label of itself, a classification label of a maximum prediction value is selected as a final classification label, if the final classification label is malicious, then traffic corresponding to the traffic statistical information is malicious traffic, otherwise, the traffic is non-malicious traffic; the category of the traffic can be determined without manual feature design; by using a relatively light model, the calculation amount is reduced, the model can be deployed on an edge computing node, the feature extraction capability and practicability are enhanced, and the problems of insufficient precision and insufficient universality are overcome.

Description

TECHNICAL FIELD

[0001] The application relates to a malicious traffic detection method, system and device and a storage medium, and belongs to the technical field of network traffic analysis and cyberspace security application. BACKGROUND

[0002] With the rapid development of new generation information technologies represented by the Internet, the Internet of Things (IoT), big data and artificial intelligence, and the accelerated integration with traditional industries, a new round of global technological and industrial revolution is booming, and new production methods, organizational methods and business models are emerging. Industrial Internet of Things (IIoT) has emerged as the times require, driving the intelligent transformation of the global industrial system.

[0003] Compared with traditional IoT, in IIoT, the number of device components is usually several orders of magnitude higher, and the connection between components is very complex. The cost of manual malicious traffic detection based on experience and signature is very high. In addition, compared with traditional IoT, IIoT often involves higher value device assets and is often applied in industries with higher importance, such as energy, transportation, industrial control, etc. Therefore, the accuracy of network attack detection and timely handling of abnormalities have higher requirements, and therefore, it is increasingly important to design an efficient, accurate, stable and robust IIoT malicious traffic detection method.

[0004] However, due to the complexity of IIoT devices and the massive communication between components mentioned above, it can be predicted that the computational overhead of traditional malicious traffic detection will become very large, so that the cloud computing center will not be able to bear it; in order to solve this problem, researchers have proposed new distributed intelligent computing network architectures, such as edge computing, to make up for the shortcomings of cloud computing; these technologies allow edge computing nodes to provide services to nearby data sources in a distributed, low-latency and highly available manner, offloading computing tasks to edge nodes, solving the resource shortage problem in IIoT, and meeting the computing, storage and control requirements of IIoT.

[0005] Similar to other services, traditional centralized network malicious traffic detection architecture is difficult to adapt to distributed environments, in addition, the multiple and massive communication between computing nodes caused by distributed computing not only increases the complexity of IIoT component communication, but also makes distributed computing nodes become new vulnerable objects. Therefore, a better way is to deploy directly on edge nodes, deploy malicious traffic detection to edge nodes, and provide low-latency security support for directly connected network devices, but compared with computing centers and distributed computing, edge computing nodes often lack sufficient computing power.

[0006] Network malicious traffic detection is one of the necessary tasks of computer network. In today's world, new network architectures are emerging, and the scale and complexity are expanding. Network security problems have become an obstacle to network development. Traditional network malicious traffic detection methods can be roughly divided into two categories: the first category is based on signature, and the second category is based on features.

[0007] The signature-based method identifies abnormal traffic by matching the input sample with a series of known network attack sample patterns. This method requires maintaining a database recording abnormal behavior rules, which is costly and time-consuming. Since new network attack types are constantly emerging, this method cannot adapt to the security needs of today's high network throughput.

[0008] The feature-based method compensates for this defect. These methods identify abnormal behavior in the current network by analyzing and learning historical data and statistical features. Machine learning methods have greater potential in detecting unknown abnormal behavior.

[0009] Machine learning-based methods are usually based on statistical features and require manual design and selection of features. Current work usually includes two parts: feature extraction and algorithm design.

[0010] In summary, the current work on industrial Internet of Things malicious traffic detection still has the following shortcomings: 1. With the popularity of encryption technology and obfuscation technology, traffic features are prone to change. Rule-based methods (including port-based and load-based methods) are difficult to extract rules, and are prone to failure after traffic changes, with low time efficiency. 2. Machine learning methods based on traffic packet content are difficult to manually design features, traffic packet content is more complex, and irrelevant information is lower, with poor real-time performance. 3. Deep learning-based algorithms usually have high computational cost and cannot be deployed on edge computing nodes, and real-time performance and security cannot be guaranteed. 4. Deep learning-based algorithms usually have low universality and are difficult to achieve the desired effect in different scenarios. SUMMARY

[0011] The purpose of the present application is to provide a malicious traffic detection method, system, device and storage medium, which solves the problems of manual feature design difficulty, inability to deploy on edge computing nodes, poor real-time performance and universality, poor feature extraction capability and the like in the prior art.

[0012] To achieve the above purpose, the present application adopts the following technical solutions:

[0013] In a first aspect, the present application provides a malicious traffic detection method, comprising:

[0014] Obtaining traffic statistical information to be detected, and performing format preprocessing on the traffic statistical information to obtain a sample vector.

[0015] inputting the sample vector into the pre-trained neural network partial framework search network model to obtain a prediction vector;

[0016] The prediction vector includes a plurality of prediction values, each prediction value includes a classification label of itself, and a classification label of a maximum prediction value is selected as a final classification label.

[0017] With reference to the first aspect, further, the format preprocessing of the traffic statistical information to obtain the sample vector comprises:

[0018] The string type information in the traffic statistical information is one-hot encoded, and then the traffic statistical information is vectorized, normalized and standardized to obtain the formatted sample vector.

[0019] With reference to the first aspect, further, the neural network partial framework search network model is trained by the following method:

[0020] obtaining a training data set, and performing format preprocessing on training data in the training data set;

[0021] inputting the training data after the format preprocessing into the neural network partial framework search network model to obtain an output of the model;

[0022] calculating a cross-entropy loss according to the output of the model, and updating parameters of the neural network partial framework search network model according to the cross-entropy loss;

[0023] repeating the above steps until the cross-entropy loss converges.

[0024] With reference to the first aspect, further, a calculation formula of the cross-entropy loss is:

[0025]

[0026] wherein, L is the cross-entropy loss, K is a comprehensive number of predicted traffic types, I(·) is an indicator function, y is a label of a current traffic type, and p k is a softmax probability of the current traffic being the kth type.

[0027] With reference to the first aspect, further, when updating the parameters of the neural network partial framework search network model, a cosine exponential fluctuation decay learning rate updating strategy is used, which is represented as:

[0028]

[0029] Wherein, lr(epoch) is the learning rate at the epoch round of training, epoch is the number of rounds of training, epoch max is the maximum number of training rounds, lr basic is the lower limit of the learning rate, and gamma is the initial learning rate decay rate, times is the number of fluctuations during training.

[0030] In combination with the first aspect, further, in the neural network partial framework search network model, the sample vector is upgraded in dimension through a multi-linear multi-dimensional projection mechanism, so that the one-dimensional sample vector is converted into a two-dimensional matrix, the position information of the two-dimensional matrix is embedded through a partial learnable position coding based on a two-dimensional Gaussian distribution, the two-dimensional matrix is calculated through a self-attention mechanism based on multiple heads, the optimal system structure is searched through the neural network partial framework search, and finally a prediction vector is output through a fully connected layer.

[0031] In combination with the first aspect, further, the position coding matrix when embedding the position information is:

[0032]

[0033] Wherein, PE is the position information embedded in the query, the embedding method is to multiply the value of the corresponding position pos on the corresponding row row of the query with PE(pos, row) as a new query, A is a constant for scaling the range of PE, mu0, mu1, sigma0, sigma1, and rho are parameters for controlling the size of the PE value;

[0034] The expression of the function gamma(mu0, mu1, sigma0, sigma1, rho, pos, row) is:

[0035]

[0036] Secondly, the application also provides a malicious traffic detection system, comprising:

[0037] A sample vector acquisition module is configured to acquire traffic statistical information to be detected, and perform format preprocessing on the traffic statistical information to obtain a sample vector;

[0038] A sample vector processing module is configured to input the sample vector into a pre-trained neural network partial framework search network model to obtain a prediction vector;

[0039] A malicious traffic judgment module is configured to select the classification label of the maximum prediction value as a final classification label, the prediction vector comprises a plurality of prediction values, each prediction value comprises a classification label thereof, if the final classification label is malicious, the traffic corresponding to the traffic statistical information is malicious traffic, otherwise, it is non-malicious traffic.

[0040] In a third aspect, the present application further provides a malicious traffic detection device, comprising a processor and a storage medium;

[0041] The storage medium is configured to store instructions.

[0042] The processor is configured to operate according to the instructions to perform the steps of the method according to any one of the first aspect.

[0043] In a fourth aspect, the present application further provides a computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the steps of the method according to any one of the first aspect.

[0044] Compared with the prior art, the present application has the following beneficial effects:

[0045] The malicious traffic detection method, system, device and storage medium provided by the present application only need to obtain the statistical characteristics (i.e., traffic statistical information) of the traffic to determine the category of the traffic, without the need for manual feature design by experts; under the premise of using fixed-length samples to ensure training efficiency, the use of the neural network partial framework search network model makes the model relatively lightweight, and the calculation amount is greatly reduced compared with traditional deep learning models, which can be deployed on the edge computing nodes of industrial Internet of Things, greatly enhancing the feature extraction capability and practicability of the model, and overcoming the problems of insufficient model precision and insufficient universality.

[0046] Moreover, the present application further proposes to use a multi-linear multi-dimensional projection mechanism to upgrade the sample vector, so as to convert the one-dimensional sample vector into a two-dimensional matrix, solving the problem of too far distribution of important features of the input feature sequence. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is one of the flowcharts of the malicious traffic detection method provided by the embodiments of the present application;

[0048] Figure 2 is the second flowchart of the malicious traffic detection method provided by the embodiments of the present application;

[0049] Figure 3 is a structural schematic diagram of the neural network partial framework search network model provided by the embodiments of the present application;

[0050] Figure 4 is a schematic diagram of the multi-linear multi-dimensional projection mechanism provided by the embodiments of the present application. DETAILED DESCRIPTION

[0051] The present application will be further described below in conjunction with the drawings, and the following embodiments are only used to more clearly illustrate the technical solutions of the present application, and cannot be used to limit the protection scope of the present application.

[0052] Embodiment 1

[0053] As Figure 1 shown, the malicious traffic detection method provided by the embodiment of the application comprises the following steps:

[0054] S1, obtaining traffic statistical information to be detected, and performing format preprocessing on the traffic statistical information to obtain a sample vector.

[0055] The information statistics of the traffic to be detected are obtained, and the traffic statistical information is obtained.

[0056] The information in the traffic statistical information that is a string of information is one-hot encoded, and one classification variable is replaced by one or more new features, and the new features take values of 0 and 1.

[0057] Since the quantitative units of each type in the traffic statistical information are different, and the numerical difference is large, in order to improve the training speed and model accuracy, it is necessary to normalize each type; therefore, the one-hot encoded traffic statistical information is vectorized, normalized and standardized to obtain a formatted sample vector.

[0058] S2, inputting the sample vector into a pre-trained neural network partial framework search network model to obtain a prediction vector.

[0059] The neural network partial framework search network model is pre-constructed, as Figure 3 shown, in the neural network partial framework search network model, the sample vector is dimensioned by a multi-linear multi-dimensional projection mechanism, so that the one-dimensional sample vector is converted into a two-dimensional matrix, the position information of the two-dimensional matrix is embedded by a partial learnable position coding based on a two-dimensional Gaussian distribution, the two-dimensional matrix is calculated by a self-attention mechanism based on a multi-head self-attention mechanism, the optimal system structure is found by a neural network partial framework search, and finally the prediction vector (the one-hot prediction label matrix in Figure 3 ) is output by a full connection layer.

[0060] As Figure 4 shown, the multi-linear multi-dimensional projection mechanism is a multi-linear multi-dimensional projection mechanism with a shortened distance between features, and the specific method is as follows:

[0061] (1) first, the sample vector is passed through h full connection layers to generate h sequences of length m', respectively γ1, γ2, γ3……γ h .

[0062] (2) then, the above sequence is reversed to obtain the sequence γ1’, γ2’, γ3’……γ h ’.

[0063] (3) next, from γ1, γ2, γ3……γ hSelect h-1 sequences, numbered λ1, λ2, λ3...λ h-1 To perform a shift operation, the specific method is as follows: select the j-th sequence, and insert the feature of the i-th position into the j-th position. The positions are used to obtain the sequence λ1, λ2, λ3……λ h-1 .

[0064] (4) Then the above γ1, γ2, γ3……γ h ,γ1',γ2',γ3'……γ h '、λ1,λ2,λ3……λ h-1 The concatenation process yielded a multidimensional matrix of size m'*(3h-1), with the following concatenation order: γ1,γ2',λ1,γ2,γ3',λ2,γ3,γ4',λ3……γ h ',λ h-1 ,γ h ',γ1'.

[0065] like Figure 4 As shown, the multilinear multidimensional projection mechanism can reuse single data. The computational load can be reduced to a large extent by window translation and reverse overlap operations, and each feature can be moved as far away from its original position as possible to reduce the maximum distance between any two features. This distance can be approximated as the computational difficulty of obtaining the relationship between two features during the convolution process.

[0066] The position of statistical features of data packets during network traffic propagation is fixed, so the order of occurrence has a significant impact on the results. In the past, when processing features that strongly depend on logical order, researchers often used Long Short-Term Memory (LSTM) artificial neural networks for feature extraction. LSTM can process multiple data feature vectors in the same sample simultaneously and capture the time-series relationship between different data. However, LSTM loses a lot of information during long-distance propagation and is not sensitive to feature importance. Therefore, this embodiment of the invention uses a multi-head attention mechanism to extract important statistical features of traffic.

[0067] Before performing self-attention calculation, for features with a logical sequence, positional encoding (PE) is needed to manually add positional information to the input features for identification. This addresses the lack of positional information inherent in the self-attention mechanism compared to traditional convolutional neural networks and other neural network modules. The positional encoding matrix during positional information embedding is as follows:

[0068]

[0069] Wherein, PE is the position information embedded in the query, the embedding method is to multiply the value of the corresponding position pos on the corresponding row row of the query with PE(pos, row) as a new query, A is a constant for scaling the range of PE, mu0, mu1, sigma0, sigma1, rho are parameters for controlling the size of the PE value;

[0070] The expression of the function gamma(mu0, mu1, sigma0, sigma1, rho, pos, row) is:

[0071]

[0072] Neural Architecture Search (NAS) can find an effective architecture for a specific deep learning problem without human intervention, thereby replacing the process of designing a complex network architecture. NAS can be roughly regarded as an optimization problem, and the key method is to construct a large network architecture search space, develop an effective algorithm to explore the space, and find the optimal structure under the combination of training data and specific constraints such as limited model size or minimum inference speed limit.

[0073] Neural Architecture Partical Search (NPAS) is a concept proposed by the present patent. As described above, various NAS frameworks use convolutional layers and pooling layers as basic computing units, and the computing mode is relatively simple. The present embodiment combines the network model of malicious traffic detection with the multi-head self-attention mechanism, but compared with the convolutional layer, the calculation overhead of the multi-head self-attention mechanism is very large, and if a subnetwork is added, the search speed will be greatly affected. Therefore, in the present embodiment, only part of the backbone network participates in the search process.

[0074] The function is that the model has the characteristics of light weight, can be deployed on edge computing nodes to reduce the burden of industrial Internet of Things computing center, and has the credibility of high accuracy and low false alarm rate. Compared with other malicious traffic detection models, the false alarm rate of the present model is usually 1-2 orders of magnitude lower under the same data set. In addition, the model described in the present embodiment also has universality in various scenes, which is reflected in that the network architecture changes with the change of training data.

[0075] The neural network part framework search network model is trained by the following method:

[0076] Obtain a training data set, and perform format preprocessing on the training data in the training data set;

[0077] Input the training data preprocessed in format into the neural network part framework search network model to obtain the output of the model;

[0078] Calculate the cross-entropy loss according to the output of the model, and update the parameters of the neural network part framework search network model according to the cross-entropy loss;

[0079] Repeat the above steps until the cross-entropy loss converges.

[0080] The formula for calculating the cross-entropy loss is:

[0081]

[0082] Where L is the cross-entropy loss, K is the predicted traffic class comprehensive number, I(·) is the indicator function, y is the label of the current traffic class, and p k is the softmax probability of the current traffic being the kth class.

[0083] When updating the parameters of the neural network part framework search network model, the cosine exponential fluctuation decay learning rate update strategy is used, which is represented as:

[0084]

[0085] Where lr(epoch) is the learning rate at the epoch training, epoch is the number of training rounds, epoch max is the maximum training round, lr basic is the lower limit of the learning rate, γ is the initial learning rate decay rate, times is the number of fluctuations in the training process.

[0086] In the neural network part framework search network model of the embodiment of the application, the neural units are stacked multiple times to form a backbone convolutional neural network; two types of neural units (normal units and restoration units) are defined, the normal units are units that maintain the feature tensor space resolution, and the restoration units are units that divide the space resolution by 2 and multiply the number of filters by 2; the units located at 1 / 3 and 2 / 3 of the total depth are set as restoration units, and the other units are normal units, all normal units share the same structure, all restoration units respectively share the same structure, and the output of the last unit is then fed into an average pooling layer, followed by a fully connected layer that outputs softmax probabilities.

[0087] Two groups of parameters are defined: a group of structure parameters α that control operation selection and a group of weight parameters ω of all operations in O; the structure parameter α ij ∈R|O| is used to select a specific operation o ijThe categorical choice relaxation is softmax over all possible operations in the search space; therefore, the search space becomes continuous, and the neural network part framework search can be achieved by optimizing the structure parameters; in addition, since there are two types of neural units (normal units and restoration units), the structure parameters become α = (α 正常 ,α 还原 ), where α 正常 is shared in all normal units, and α 还原 is shared in all restoration units.

[0088] The partial channel connection differentiable neural network part framework search algorithm jointly learns α and ω by backpropagation; the training loss is denoted as L 训练集 (ω,α), and the validation loss is denoted as L 验证集 (ω,α); the neural network part framework search process can be regarded as a double-layer optimization problem, and the purpose is to find an optimal α that minimizes L 验证集 (ω,α), where the optimal ω is determined by minimizing L 训练集 (ω,α):

[0089]

[0090]

[0091] where s.t. means to make it satisfy the condition, and argmin ω L 训练集 (ω,α) means the value of ω when L 训练集 (ω,α) takes the minimum value.

[0092] The cross-entropy loss is used for L 训练集 and L 验证集 :

[0093]

[0094] where L is the cross-entropy loss, K is the predicted traffic category comprehensive number, I(·) is the indicator function, y is the label of the current traffic category, and p k is the softmax probability of the current traffic being the kth category.

[0095] When the operation selection in the neural unit converges, the algorithm terminates, and whether the operation selection in the neural unit converges is measured by the entropy of the structure parameter α:

[0096]

[0097] The smaller the entropy, the higher the confidence of selecting a specific operation among all possible operations.

[0098] For each node xj , reserve all previous nodes x i The two operations (except for the zero operation) with the highest softmax probability in x

[0099]

[0100] where, denotes the natural exponential operation, is the softmax probability of operation o between nodes (i,j) defined as: is a hyperparameter for the weighted operation o(x i ) on nodes (i,j).

[0101] The convolutional neural network is constructed by stacking multiple neural units derived.

[0102] As shown in Figure 2 , the sample vector is input into the pre-trained neural network partial framework search network model to obtain a prediction vector.

[0103] S3, the prediction vector contains multiple prediction values, each prediction value contains its own classification label, and the classification label of the maximum prediction value is selected as the final classification label, if the final classification label is malicious, the traffic corresponding to the traffic statistical information is malicious traffic, otherwise it is non-malicious traffic.

[0104] As shown in Figure 2 , the malicious traffic detection method provided by the embodiment of the application can also be summarized as the following steps:

[0105] The traffic statistical information (i.e. the original traffic statistical feature in a specific scenario in Figure 2 ) is preprocessed, and the specific preprocessing method is described above, to obtain a sample vector, the sample vector is divided into a training data set and a verification data set; the sample vector in the training data set is input into the neural network partial framework search network model for training, and the training method is described above, and the model is solidified after training; the sample vector in the verification data set is directly input into the trained neural network partial framework search network model to obtain a prediction vector (i.e. the output of the final model in Figure 2 ), and the classification label of the maximum prediction value in the prediction vector is taken as the final classification label, if the final classification label is malicious, the traffic corresponding to the traffic statistical information is malicious traffic, otherwise it is non-malicious traffic.

[0106] In summary, the malicious traffic detection method provided by the embodiment of the application uses the feature extraction capability of neural network technology and the automatic reconstruction capability of the neural network partial framework search model, and only through the statistical features of the traffic, the class of the traffic can be identified with high precision, high speed and low computational cost.

[0107] Embodiment 2

[0108] The embodiment of the present application provides a malicious traffic detection system, which comprises:

[0109] The sample vector acquisition module is used for acquiring traffic statistical information to be detected, and performing format preprocessing on the traffic statistical information to obtain a sample vector.

[0110] The sample vector processing module is used for inputting the sample vector into a pre-trained neural network partial framework search network model to obtain a prediction vector.

[0111] The malicious traffic judgment module is used for selecting a classification label of a maximum prediction value as a final classification label, wherein the prediction vector comprises a plurality of prediction values, each prediction value comprises a classification label of itself, if the final classification label is malicious, then traffic corresponding to the traffic statistical information is malicious traffic, otherwise, the traffic is non-malicious traffic.

[0112] Embodiment 3

[0113] The embodiment of the present application provides a malicious traffic detection device, which comprises a processor and a storage medium.

[0114] The storage medium is used for storing instructions.

[0115] The processor is used for performing operations according to the instructions to execute steps of the following method:

[0116] Traffic statistical information to be detected is acquired, and format preprocessing is performed on the traffic statistical information to obtain a sample vector.

[0117] The sample vector is input into a pre-trained neural network partial framework search network model to obtain a prediction vector.

[0118] The prediction vector comprises a plurality of prediction values, each prediction value comprises a classification label of itself, a classification label of a maximum prediction value is selected as a final classification label, if the final classification label is malicious, then traffic corresponding to the traffic statistical information is malicious traffic, otherwise, the traffic is non-malicious traffic.

[0119] Embodiment 4

[0120] The embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize steps of the following method:

[0121] Traffic statistical information to be detected is acquired, and format preprocessing is performed on the traffic statistical information to obtain a sample vector.

[0122] The sample vector is input into a pre-trained neural network partial framework search network model to obtain a prediction vector.

[0123] The prediction vector comprises a plurality of prediction values, each prediction value comprises a classification label of itself, a classification label of a maximum prediction value is selected as a final classification label, if the final classification label is malicious, then the traffic corresponding to the traffic statistical information is malicious traffic, otherwise, the traffic corresponding to the traffic statistical information is non-malicious traffic.

[0124] Those skilled in the art will understand that embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more blocks.

[0126] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction apparatus, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more blocks.

[0127] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus, so that a series of operation steps are performed on the computer or other programmable data processing apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more blocks.

[0128] The above merely describes the preferred embodiments of the present application, and it should be pointed out that, for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present application, and these improvements and modifications should also be considered as the protection scope of the present application.

Claims

1. A method for detecting malicious traffic, characterized in that, include: Obtain the traffic statistics information to be detected, and perform format preprocessing on the traffic statistics information to obtain the sample vector; The sample vector is input into a pre-trained neural network partial framework search network model to obtain the prediction vector; The prediction vector contains multiple prediction values, and each prediction value contains its own classification label. The classification label of the largest prediction value is selected as the final classification label. If the final classification label is malicious, the traffic corresponding to the traffic statistics information is malicious traffic; otherwise, it is non-malicious traffic. The neural network partial frame search network model includes a linear projection layer, a multi-head self-attention mechanism and position encoding layer, a neural network partial frame search layer, and a classification layer connected in sequence. The multi-head self-attention mechanism and position encoding layer includes a multi-head self-attention mechanism and a partially learnable position encoding based on a two-dimensional Gaussian distribution. In the neural network partial frame search network model, the sample vector is upgraded through the multi-linear multi-dimensional projection mechanism of the linear projection layer, transforming the one-dimensional sample vector into a two-dimensional matrix. Position information is embedded in the two-dimensional matrix through the partially learnable position encoding based on a two-dimensional Gaussian distribution. Then, self-attention calculation is performed on the two-dimensional matrix based on the multi-head self-attention mechanism. The optimal network architecture is found through the neural network partial frame search in the neural network partial frame search layer, resulting in a backbone convolutional neural network. Self-attention processing is performed by the backbone convolutional neural network to obtain the predicted feature vector. Finally, the predicted feature vector is classified by the classification layer to output the predicted vector. A network architecture search space is pre-constructed in the neural network partial framework search layer, and the backbone convolutional neural network is the optimal network architecture obtained by searching from the network architecture search space. The backbone convolutional neural network consists of multiple stacked neural units connected to an average pooling layer. The neural units include normal units and reduced units. Normal units are units that maintain the spatial resolution of the feature tensor, while reduced units are units that divide the spatial resolution by 2 and multiply the number of filters by 2. Neural units located at 1 / 3 and 2 / 3 of the total depth are set as reduced units, and the other neural units are normal units. All normal units share the same structure, and all reduced units share the same structure respectively. The last neural unit is connected to the average pooling layer.

2. The malicious traffic detection method according to claim 1, characterized in that, The process of preprocessing the traffic statistics information to obtain the sample vector includes: The string-type information in the traffic statistics is one-hot encoded, and then the traffic statistics are vectorized, normalized, and standardized to obtain a formatted sample vector.

3. The malicious traffic detection method according to claim 1, characterized in that, The neural network partial framework search network model is trained using the following method: Obtain the training dataset and perform format preprocessing on the training data in the training dataset; The pre-processed training data is input into the neural network framework search network model to obtain the model's output; Calculate the cross-entropy loss based on the model's output, and update the parameters of the neural network partial framework search network model based on the cross-entropy loss; Repeat the above steps until the cross-entropy loss converges.

4. The malicious traffic detection method according to claim 3, characterized in that, The formula for calculating the cross-entropy loss is: ； in, It is cross-entropy loss. It is the predicted total number of traffic types. It is an indicator function. It is a tag for the current traffic type. The current traffic is the [number]th The softmax probability of the class.

5. The malicious traffic detection method according to claim 3, characterized in that, When updating the parameters of the neural network model in the framework, a cosine exponential decay learning rate update strategy was used, expressed as: ； in, It is the learning rate during the training cycle of the epoch. It is the number of training rounds. It is the maximum number of training rounds. It is the lower bound of the learning rate. It is the initial learning rate decay rate. , It refers to the number of fluctuations during the training process.

6. The malicious traffic detection method according to claim 1, characterized in that, The location encoding matrix for embedding location information is as follows: ； in, To embed location information in a query, the embedding method is to select the corresponding row in the query. The corresponding position above The value and Multiplication is used as a new query. It is a constant used to scale the PE range. It is a parameter used to control the magnitude of the PE value; function The expression is: 。 7. A malicious traffic detection system based on the method of any one of claims 1 to 6, characterized in that, include: Sample vector acquisition module: used to acquire the traffic statistics information to be detected, and to preprocess the traffic statistics information to obtain sample vectors; Sample vector processing module: used to input sample vectors into a pre-trained neural network partial framework search network model to obtain prediction vectors; Malicious Traffic Judgment Module: This module selects the classification label with the largest predicted value as the final classification label. The prediction vector contains multiple predicted values, and each predicted value contains its own classification label. If the final classification label is malicious, the traffic corresponding to the traffic statistics information is malicious traffic; otherwise, it is non-malicious traffic.

8. A malicious traffic detection device, characterized in that, Including processor and storage media; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the method according to any one of claims 1 to 6.

Images