SDN network abnormal traffic classification device and method based on parallel fusion of double-layer attention and space-time features

Abstract

The application discloses an SDN network abnormal traffic classification device and method based on double-layer attention and parallel fusion of space-time features, (1) converting a data set into a one-dimensional byte sequence and a two-dimensional digital matrix, and performing batch normalization processing; (2) an L2-BiTCN model: the byte sequence is transmitted into a one-layer BiTCN model, the weight distribution of byte data is calculated through a byte attention mechanism, and a byte data packet vector is obtained; the data packet vector with the byte weight is taken as input and transmitted into a two-layer BiTCN model, the weight distribution of the data packet is calculated through a data packet attention mechanism, and a flow time sequence feature vector f1 is obtained; (3) a CNN model: the digital matrix is transmitted into a CNN model, two rounds of convolution and average pooling operations are performed using convolution kernels of different sizes, the obtained local feature matrix is subjected to a Flatten dimension reduction, and then a one-dimensional tensor is subjected to a Concat connection, so that a flow space feature vector f2 is obtained; and (4) f1 and f2 are fused to obtain a space-time feature vector f, and a final traffic category is obtained by using a Softmax classifier.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of data security, in particular to an SDN network abnormal flow classification device and method based on double-layer attention and parallel fusion of space-time features. BACKGROUND

[0002] With the continuous development of information technology, network attack cases occur frequently, the network environment is constantly diversifying, malicious network activities are constantly threatening people's information infrastructure, application and data security, etc., so effective identification of network abnormal flow to achieve accurate prevention of network attacks has become an important task of network space security. Since the traditional network architecture distributes the flow observation point on each forwarding device, it is difficult to effectively implement anomaly detection, software-defined network (Software-Defined Networking, SDN) as a new network architecture can decouple the control and forwarding functions of the device, has the characteristics of separation of control and forwarding, centralized monitoring, centralized control, etc., providing a new method and means for studying network abnormal flow classification.

[0003] At present, there are mainly four types of research on flow classification methods: classification based on port number, which is simple and easy to implement, but has low precision; classification based on deep packet inspection (DPI), which has high accuracy, but cannot process encrypted traffic and has high complexity; classification based on statistics and behavior, which are based on machine learning, have low computational complexity and can be used for encrypted traffic, but require special feature design. In recent years, deep learning has been widely used to solve network flow classification problems. This method can reduce the workload of manual feature extraction and has better accuracy and portability.

[0004] Network flow is essentially a time series data, which is a one-dimensional byte stream organized in a hierarchical structure. From low to high, it is byte, frame, session, and entire flow. This structure is very similar to the structure of letters, words, sentences, and paragraphs in natural language processing. Recent research has found that for sequential processing, the TCN architecture is not only more accurate than classic recurrent networks (such as LSTM and GRU), but also simpler and clearer, and it may be a more appropriate starting point for applying deep networks to sequences. In addition, adding an attention mechanism to the convolutional network can achieve better results on a large number of natural language processing tasks, but it has not yet been applied to network flow classification problems.

[0005] But whether it is traditional machine learning or deep learning model, most of them take network traffic packet header and whole flow statistical information as feature extraction object, ignoring the value of payload data in network traffic. Secondly, the importance of various information in network traffic for traffic classification decision is different, if only considering the time sequence characteristics or spatial characteristics of traffic, using standard CNN, RNN and other neural networks, the capture ability of important information is insufficient; Finally, the context features and spatial features of network traffic will also have a certain influence on the final classification result, the semantic capture ability of one-way TCN structure is obviously insufficient, and further improvement and optimization are needed.

[0006] Therefore, the method extracts the payload data in the traffic data packet, takes BiTCN and CNN architecture as the research model, further combines the double-layer attention mechanism for the BiTCN model, captures important time sequence feature information at the byte and packet level, uses different sizes of convolution kernels for the CNN model, extracts spatial feature information between data packets, and finally fuses the time sequence features and spatial features of the network flow to generate more accurate traffic space-time feature vectors, so as to realize effective classification of network traffic data. SUMMARY

[0007] In view of the above problems, the present application provides a SDN network abnormal traffic classification device and method based on double-layer attention and parallel fusion of space-time features. First, the input traffic data is preprocessed to generate a one-dimensional network traffic byte sequence and a two-dimensional digital matrix. Secondly, before the L2-BiTCN+CNN (i.e. double-layer bidirectional TCN+CNN) model training or processing data, the one-dimensional network traffic sequence is batch normalized to speed up the fitting speed of the model; then, in the L2-BiTCN+CNN model training process, the LeakyReLU activation function is used instead of the traditional ReLU function to solve the neuron death problem; at the same time, the double-layer attention mechanism is introduced into the L2-BiTCN architecture to capture the key byte and packet time sequence feature information f1, and three sizes of convolution kernels are used for the CNN architecture, and after the average pooling layer and the flattening layer, the spatial hierarchical structure features f2 of different bytes in the data packet are obtained, and the flow time sequence features f1 and spatial features f2 are fused to generate more accurate traffic space-time feature vectors f. Finally, the network flow global space-time feature vector f is input into the Softmax classifier to obtain the final traffic category.

[0008] Specifically, the model data input in the present scheme adopts two different forms after processing of the original flow data: one-dimensional network flow byte sequence and two-dimensional digital matrix, which can eliminate the information loss caused by reshaping operation. The designed TCN layer has 4 layers, and the expansion factor η of each layer is 1, 2, 4 and 8 respectively, and the filter size K is 2. The connection between layers adopts residual structure, and each residual block is composed of causal convolution, dilated convolution and residual connection. The bidirectional TCN structure, BiTCN, is used to obtain the forward feature and reverse feature of the flow, and the context relationship of the flow is obtained by fusing them, so as to improve the accuracy of classification. For the CNN architecture, each flow is represented as a (N, T) two-dimensional digital matrix, and 3*3, 2*5 and 1*5 convolution kernels are used to extract the spatial texture between bytes in different packets, with a step size of 1, a channel number of 16, a padding of 0, and a 2*2 Average pooling with a stride of 1. After the Flatten layer, three one-dimensional local spatial feature tensors are obtained, and finally the local feature tensors are fused to obtain the global spatial feature of the flow.

[0009] The specific scheme is as follows:

[0010] A SDN network abnormal flow classification method based on parallel fusion of double-layer attention and space-time features, comprising the following steps:

[0011] S1: Preprocessing the original flow data to generate one-dimensional network flow byte sequence and two-dimensional digital matrix, and performing batch normalization processing on the network flow sequence;

[0012] S2: Inputting the data processed by S1 into L2-BiTCN+CNN model for training or processing, the L2-BiTCN+CNN model comprising an L2-BiTCN model and a CNN model, the L2-BiTCN model being used to capture the time sequence features f1 of key bytes and packets, and the CNN model being used to obtain the spatial features f2 of bytes in different packets,

[0013] S3: Fusing the time sequence features f1 and the spatial features f2 to generate flow space-time feature vector f, and inputting the flow space-time feature vector f into a Softmax classifier to obtain the final flow category.

[0014] Further, the specific process of S1 is as follows:

[0015] S1.1: Flow segmentation stage: using the editcap tool in Wireshark software, mainly cutting the obtained original flow data into multiple discrete network flow data according to the flow or session;

[0016] S1.2: Flow anonymization stage: The.pcap file after segmentation contains multiple packets, and this stage mainly extracts the payload data in the packet, reduces its influence on the flow classification result by deleting the IP address;

[0017] S1.3: Flow cleaning stage: This stage traverses the network stream data after anonymization, deletes duplicate data and packets with payload data length of 0, and processes the packets into a fixed length, greater than which is truncated, and less than which is padded with 0;

[0018] S1.4: Input format generation stage: This stage converts the fixed-length stream data into a format. First, the network stream data is processed into a one-dimensional byte sequence, the data is read in hexadecimal, and is labeled for the L2-BiTCN model. Then the network stream data is converted into a two-dimensional digital matrix, the data is read in IDX format, and is labeled for the CNN model.

[0019] Further, the L2-BiTCN model of S2 includes a byte level and a packet level, the byte level includes a byte embedding layer, a BiTCN layer, and a byte attention layer, and the packet level includes a packet embedding layer, a BiTCN layer, and a packet attention layer. A batch normalization layer is added in front of the first convolutional layer, and weight normalization is adopted in the TCN layer, the attention layer, and the fully connected layer.

[0020] The steps of training or processing data of the L2-BiTCN model are as follows:

[0021] Step 1: The byte sequence is transmitted as input to the embedding layer in the byte level, and is represented as x it , where x it = b it e, b it represents the i-th byte data in the i-th packet, e R T*d represents the word vector matrix, T represents the number of bytes in the packet, d represents the word vector dimension, and X i = {x i1 , x i2 , …, x it , … x iT} represents the set of i-th packet byte information word vectors.

[0022] Step 2: The word vector set X i = {x i1 , x i2 , …, x it , … x iTThe input is input into the BiTCN layer in the byte level and is subjected to batch normalization, and then the TCN encodes the input byte data word vector;

[0023] Step 3: Introduce the byte attention mechanism, calculate the weight distribution of the byte, give higher weight to important features, and obtain the data packet vector p with byte weight i ;

[0024] Step 4: Obtain the data packet vector p with byte weight i , which is then input as input data into the BiTCN layer in the packet level;

[0025] Step 5: The BiTCN layer in the packet level encodes the input data packet vector p i ;

[0026] Step 6: Introduce the packet attention mechanism, calculate the weight distribution of the packet, give higher weight to important features, and finally obtain the network flow time sequence feature vector f1.

[0027] Further, the specific process of step 2 is as follows:

[0028] Step 2.1: Introduce dilated convolution: define filter F=(f1,f2,…,f k ,...,f K ), respectively representing filters of sizes 1, 2, k, K, x it The dilated convolution formula at x is as follows:

[0029]

[0030] Where c it represents the feature of the forward network flow, η is the dilation factor, K is the size of the filter, t-(K-k)η represents the previous direction information, when η=1, it is ordinary convolution, when η=2, it is sampling every two input point data;

[0031] Step 2.2: Add a residual module for identity mapping of cross-layer connection; the specific process is as follows:

[0032] Step 2.2.1: Obtain c it after step 2.1 processing, then the network weight is subjected to weight normalization;

[0033] Step 2.2.2: Use the activation function LeakyReLU for nonlinear transformation, and the obtained new forward network flow feature vector is The formula is as follows:

[0034]

[0035] Where w1 represents the weight matrix, b1 represents the bias, and α is a coefficient, which can be understood as the gradient value assigned on the negative axis of the activation function.

[0036] Step 2.2.3: Use Dropout for regularization, randomly select neurons in the hidden layer, and then delete them. Set Dropout to 0.2.

[0037] Step 2.3: Repeat steps 2.1 and 2.2 once, design a 1*1 Conv to transform x so that the transformed H(x) and x can be added together;

[0038] Step 2.4: For the word vector set X i ={x i1 ,x i2 ,…,x it ,…x iT Reverse the sequence to obtain the reverse matrix X′. i ={x iT …,x it ,…,x i2 ,x i1 The reverse sequence is fed into the reverse TCN model for training or processing to learn the reverse traffic feature c′. it , as in the formula

[0039] c′ it =TCN(X′) i ) (Formula 3)

[0040] The TCN function processing is as described in formula (1), followed by repeating steps 2.2 and 2.3, where step 2.2.2 is changed to process c′. it Using the LeakyReLU activation function for nonlinear transformation, the resulting new reverse network traffic feature vector is: The formula is as follows:

[0041]

[0042] Where w2 represents the weight matrix, b2 represents the bias, and α is a coefficient, which can be understood as the gradient value assigned on the negative axis of the activation function;

[0043] Step 2.5: Calculate the positive eigenvectors and reverse eigenvectors and Establish a connection and generate feature vectors for data packets.

[0044] Furthermore, the specific process of step 3 is as follows:

[0045] Step 3.1: Simultaneously set h itInput into Embedding for mapping, respectively, to three different spaces, where the formula as (5) (6) (7) shown, W q ,W k and W v represent a random different space matrix, respectively, to get Query matrix Q = {q it}, Key matrix K = {k it}, Value matrix V = {v it}.

[0046] Step 3.2: the mapping matrix Q and K dot product h it and other data packet feature vector between the degree of association Simi, Simi through the Softmax function to get a normalized attention weight matrix α it , α it represent the first t byte information in the weight of the data packet i, such as formula (8) (9);

[0047] Step 3.3: finally, the normalized weight matrix α it and v it weighted sum, update each byte feature representation, get data packet vector p i , such as formula (10);

[0048] Q = W q *h it (formula 5)

[0049] K = W k *h it (formula 6)

[0050] V = W v *h it (formula 7)

[0051]

[0052] p i = ∑ t α it v it (formula 10)

[0053] Wherein, the introduction of c' to prevent overflow of the calculation results, c' generally takes the maximum value in the input signal.

[0054] Further, the specific process of step 5 is as follows:

[0055] Step 5.1: data packet level BiTCN processing process is the same as the byte level BiTCN, data packet p i at the inflation convolution formula as follows,

[0056]

[0057] where c i represents the forward traffic packet feature, η is the inflation factor, K is the size of the filter, i-(K-k)η represents the previous direction information;

[0058] Step 5.2: First, the network weight is normalized, and then the residual module uses the activation function LeakyReLU for nonlinear transformation, and the new forward traffic packet feature obtained is The formula is as follows:

[0059]

[0060] where w3 represents the weight matrix, b3 represents the bias, and a is the coefficient;

[0061] Regularization is performed using Dropout, which randomly selects neurons in the hidden layer and then deletes them. The Dropout is set to 0.2.

[0062] Step 5.3: Repeat step 5.1 and step 5.2 once, and design a 1*1Conv to transform x, so that the transformed x and H(x) can be added;

[0063] Step 5.4: Reverse the packet feature set P = {p1, p2, …, p i ,…p s} that has been processed forward, to obtain the reverse matrix P' = {p s ,…,p i ,…,p2, p1}, where s represents the number of packets in the Flow or Session after segmentation. Put the reverse matrix into the reverse TCN model for training or processing, so as to learn the reverse packet feature c' i , the formula is as follows:

[0064] c′ i = TCN(P') (formula 13)

[0065] where the TCN function processing process is described in formula (1), and then the c′ i is nonlinearly transformed using the LeakyReLU activation function, and the new reverse packet feature obtained is The formula is as follows:

[0066]

[0067] where w4 represents the weight matrix, b4 represents the bias, and a is the coefficient;

[0068] Step 5.5: The calculated forward feature vector and reverse feature vector and are connected to generate the feature vector of the data packet

[0069] Further, the specific process of step 6 is as follows:

[0070] Step 6.1: h i is input into Embedding for mapping, which is mapped into three different spaces respectively, and the formula is shown in (15) (16) (17), W q ,W k and W v represent randomly different space matrices, respectively obtaining Query matrix Q = {q i}, Key matrix K = {k i} and Value matrix V = {v i}.

[0071] Step 6.2: Then multiply the mapping matrix Q with K to obtain h i and the correlation degree Simi between other traffic feature vectors, Simi is calculated by Softmax function to obtain a normalized attention weight matrix α i , α i represents the weight of data packet i information, as formula (18) (19);

[0072] Step 6.3: Finally, the normalized weight matrix α i is weighted and summed with v i to update the feature representation of each data packet, and the network flow time sequence feature vector f1 is obtained, as formula (20);

[0073] Q = W q *h i (formula 15)

[0074] K = W k *h i (formula 16)

[0075] V = W v *h i (formula 17)

[0076]

[0077] f1 = ∑ i α i v i (formula 20)

[0078] Wherein, c' generally takes the maximum value in the input signal.

[0079] Further, the CNN model includes two rounds of Conv layers and Average Pooling layers, a Flatten layer, and a Concat layer, a batch normalization layer is added in front of the first layer of convolutional layers, and the steps of training or processing data of the CNN model are as follows:

[0080] Step 1: Process the.pcap format traffic data set into a (N, T) two-dimensional digital matrix format, and take it as the data input of the CNN model, and use the matrix to represent the two-dimensional flow data;

[0081] Where x nt represents the nth packet tth byte, A i represents the two-dimensional digital matrix of the ith data stream, with a size of (N, T);

[0082] Step 2: Conv layer: input the two-dimensional digital matrix A i into the CNN model, first select a 3*3 convolution kernel, the channel number is 16, and the activation function LeakyReLU is used for convolution operation to generate C 11 convolution layer; then use a 2*5 convolution kernel to generate C 12 convolution layer; finally, use a 1*5 convolution kernel to generate C 13 convolution layer;

[0083] Step 3: Average Pooling layer: reduce the space of the generated C 11 , C 12 , C 13 convolution layer, use 2*2 region Average pooling, that is, calculate the average value from the target region of 2*2 size, and the moving interval of the window is 1 element, map the average pooling result to obtain S 11 , S 12 , S 13 convolution layer;

[0084] Step 4: Repeat steps 2 and 3, and perform convolution operation and average pooling processing of different convolution kernel sizes again to generate C 21 , C 22 , C 23 convolution layer results and S 21 , S 22 , S 23 pooling layer results;

[0085] Step 5: Flatten layer: flatten the global average pooling layer result S 21 , S 22 , S 23Flatten flattening is performed, that is, dimensionality reduction operation is performed on the three local feature matrices to obtain corresponding one-dimensional space feature tensors 1d-tensor1, 1d-tensor2 and 1d-tensor3.

[0086] Step 6: Concat connection: the three one-dimensional space feature tensors in step 5 are fused to generate a flow space feature vector f2.

[0087] Further, the specific process of S3 is as follows:

[0088] Step 1: Concat information fusion is performed on the network flow time sequence feature f1 with byte and packet weight obtained through the L2-BiTCN model and the network flow space feature f2 obtained through the CNN model to obtain a space-time feature vector f.

[0089] Step 2: the f is obtained through a Softmax classifier to obtain the final traffic category probability P, and the formula is as follows:

[0090] P=Softmax(w c *f+b c ) (formula 21)

[0091] Wherein, w c represents a weight matrix, b c represents a bias, and c represents a current label value.

[0092] Step 3: the gradient of the cross-entropy function Loss with respect to the weight parameter is calculated, and the weight parameter is updated along the gradient direction, and the random gradient descent method (SGD) is used to find the optimal solution of the parameter, and the related formula is as follows:

[0093] Loss=-∑ c＝1 f c ln p c (formula 22)

[0094]

[0095] Wherein, c is a label value, p c is the output probability of the L2-BiTCN+CNN model calculation result, f c is the correct solution label, z represents the weight parameter to be updated, represents the gradient of the loss function with respect to z, η represents the learning rate, and <- represents updating the value on the left with the value on the right.

[0096] The application also provides an SDN network abnormal traffic classification device based on double-layer attention and parallel fusion of space-time features, which can perform the above classification method.

[0097] The application has the following beneficial effects:

[0098] 1. Using deep learning method, reduce the workload of manual extraction of traffic features.

[0099] 2. Using the payload in network traffic, the model has better accuracy and portability.

[0100] 3. Adopting double-layer attention mechanism, capturing byte and packet information, the model can generate more accurate feature vector.

[0101] 4. Using bidirectional TCN structure, the model can better capture the semantic information between flows.

[0102] 5. The CNN model uses different size convolution kernels to obtain different receptive fields and extract packet spatial texture.

[0103] 6. The model fully extracts the flow timing features and spatial features, and the robustness of the classification model is stronger.

[0104] 7. L2-BiTCN and CNN model parallel fusion, avoid the loss of traffic information in serial cascade architecture. BRIEF DESCRIPTION OF DRAWINGS

[0105] Figure 1 . The method implementation flow chart

[0106] Figure 2 . Data preprocessing flow

[0107] Figure 3 . L2-BiTCN+CNN model network structure

[0108] Figure 4 . TCN structure diagram

[0109] Figure 5 . Attention mechanism diagram DETAILED DESCRIPTION

[0110] The implementation scheme of the present invention includes: (1) Data preprocessing: preprocessing the dataset .pcap file to convert it into a one-dimensional byte sequence and a two-dimensional digital matrix, and performing batch normalization on the input traffic data; (2) L2-BiTCN model training: taking the processed byte sequence as input and feeding it into a one-layer BiTCN model, calculating the weight distribution of the byte data through the byte attention mechanism to obtain the byte data packet vector; then taking the data packet vector with byte weights as input and feeding it into a two-layer BiTCN model, calculating the weight distribution of the data packets through the data packet attention mechanism to obtain the flow time sequence feature vector f1; (3) CNN model training: feeding the processed digital matrix into the CNN model, performing two rounds of convolution and average pooling operations using convolution kernels of different sizes, and performing local feature matrix training.

[0111] Flatten dimensionality reduction, then Concat connection of one-dimensional tensors to obtain flow space feature vector f2; (4) Spatiotemporal feature vector fusion and classification: fuse flow temporal features and flow space features to obtain spatiotemporal feature vector f, and use Softmax classifier to obtain the final flow category.

[0112] The method will be further described below with reference to the accompanying drawings. It should be noted that the specific implementation of the present invention is based on this technology and provides a detailed implementation process and steps. However, the scope of protection of the present invention is not limited to this implementation example.

[0113] like Figure 1 As shown, the present invention comprises the following parts:

[0114] (1) Data preprocessing

[0115] In raw network traffic data, communication information is typically composed of a standard 5-tuple (source IP address, source port, destination IP address, destination port, protocol), and most obtained network traffic data is stored in .pcap format. However, this type of data cannot be directly used as model input for training and processing. Therefore, this method primarily targets bidirectional network traffic, such as... Figure 2 As shown, the following traffic preprocessing process is proposed:

[0116] Step 1: Traffic Segmentation Stage: This stage uses the editcap tool in Wireshark software to segment the obtained raw traffic data. The raw data can be segmented into multiple discrete network flow data according to the flow or session.

[0117] Step 2: Flow anonymization stage: The.pcap file after segmentation contains multiple packets, and this stage mainly extracts the payload data in the packet. Generally, IP addresses are considered useless data, so this method reduces their impact on traffic classification results by deleting IP addresses.

[0118] Step 3: Flow cleaning stage: This stage traverses the network flow data after anonymization, deletes duplicate data and packets with payload data length of 0, and processes the packets into a fixed length. Packets longer than the length are truncated, and those shorter are padded with 0.

[0119] Step 4: Input format generation stage: This stage converts the fixed-length flow data into a format. First, the network flow data is processed into a one-dimensional byte sequence, read in hexadecimal format, and labeled for the L2-BiTCN model. Then, the network flow data is converted back into a two-dimensional numerical matrix, read in IDX format, and labeled for the CNN model.

[0120] (2) L2-BiTCN model and CNN model training or data processing

[0121] As shown in Figure 3 , the entire L2-BiTCN model is divided into byte level and packet level. The byte level includes byte embedding layer, bidirectional TCN layer (BiTCN layer), and byte attention layer. The packet level includes packet embedding layer, bidirectional TCN layer (BiTCN layer), and packet attention layer.

[0122] To further speed up the fitting speed of the model, this method adds a batch normalization layer in front of the first convolutional layer, and adopts weight normalization processing in the TCN layer, attention layer, and fully connected layer. The steps of L2-BiTCN model training or data processing are as follows:

[0123] Step 1: The data packet after preprocessing is composed of byte sequences. The byte sequence is taken as input to the embedding layer in the byte level, represented by x it , where x it = b it e, b it represents the i-th byte data in the t-th packet, e ∈ R T*d represents the word vector matrix, T represents the number of bytes in the packet, and d represents the word vector dimension. X i = {x i1 , x i2 , …, x it , … x iT} represents the set of byte information word vectors of the i-th packet.

[0124] Step 2: The word vector set X i = {x i1 ,x i2 ,…,x iT ,…x iT} is input into the BiTCN layer in the byte level and batch normalization is performed, and then the TCN encodes the input byte data word vector, as shown in Figure 4 , and the specific processing procedure is as follows:

[0125] Step 2.1: TCN mainly realizes the processing of time series data by using 1D-FCN and causal convolution. To reduce the training time of the model, an expansion convolution is further introduced: define the filter F = (f1, f2, …, f k ,...,f K ), where the subscript represents the filter size of 1, 2, k, K, respectively, and the expansion convolution formula at x it is as follows:

[0126]

[0127] where c it represents the feature of the forward network traffic, η is the expansion factor, K is the size of the filter, and t-(K-k)η represents the previous direction information. When η = 1, it is a normal convolution, and when η = 2, it is a sampling every two input point data. Usually, η increases exponentially by 2. By increasing K and η, the receptive field (the formula for calculating the receptive field is (K-1)η+1) can be expanded.

[0128] Step 2.2: To reduce the problem of gradient disappearance caused by too deep network, a residual module is added. The residual network mainly adds an identity mapping across layers to obtain more historical details to improve the accuracy of the model.

[0129] Step 2.2.1: After obtaining c it processed in step 2.1, the network weight is then normalized.

[0130] Step 2.2.2: To avoid information loss, an activation function LeakyReLU is used for nonlinear transformation, and the new forward network traffic feature vector is obtained as The formula is as follows:

[0131]

[0132] where w1 represents the weight matrix, b1 represents the bias, and α is the coefficient, which can be understood as the gradient value given on the negative axis of the activation function.

[0133] Step 2.2.3: To prevent overfitting, use Dropout for regularization, randomly select neurons in the hidden layer and then delete them, Dropout is set to 0.2.

[0134] Step 2.3: Repeat steps 2.1 and 2.2 once, since the number of input data x and output H(x) channels may not be the same, this method designs a 1*1Conv to simply transform x, so that the transformed H(x) and x can be added.

[0135] Step 2.4: Reverse the sequence of the word vector set X i ={x i1 ,x i2 ,…,x it ,…x iT} to get the reversed matrix X′ i ={x iT …,x it ,…,x i2 ,x i1}. Put the reversed sequence into the reverse TCN model for training, so as to learn the reverse traffic feature c′ it , as shown in formula

[0136] c′ it = TCN(X′ i ) (formula 3)

[0137] Where, the TCN function processing process is described in formula (1), then repeat steps 2.2 and 2.3, and step 2.2.2 is changed to c′ it Use LeakyReLU activation function for nonlinear transformation, and the new reverse network traffic feature vector is The formula is as follows:

[0138]

[0139] Where, w2 represents the weight matrix, b2 represents the bias, and a is the coefficient, which can be understood as the gradient value given on the negative axis of the activation function.

[0140] Step 2.5: Connect the calculated forward feature vector and the reverse feature vector and to generate the feature vector of the data packet

[0141] Step 3: As shown in Figure 5 , introduce byte attention mechanism to calculate the weight distribution of bytes, and give higher weight to important features.

[0142] Step 3.1: At the same time, h itInput into Embedding for mapping, respectively, to three different spaces, where the formula as (5) (6) (7) shown, W q ,W k and W v represent randomly different space matrix, respectively, get Query matrix Q = {q it}, Key matrix K = {k it}, Value matrix V = {v it}.

[0143] Step 3.2: again with the mapping matrix Q and K dot product h it and other data packet feature vector between the degree of association Simi, Simi through the Softmax function to get a normalized attention weight matrix α it , α it represent the first t byte information in the weight of data packet i, such as formula (8) (9).

[0144] Step 3.3: finally, the normalized weight matrix α it and v it weighted sum, update each byte feature representation, get data packet vector p i , such as formula (10).

[0145] Q = W q *h it (formula 5)

[0146] K = W k *h it (formula 6)

[0147] V = W v *h it (formula 7)

[0148]

[0149] p i = ∑ j α it v it (formula 10)

[0150] Wherein, the introduction of c' to prevent overflow of the calculation results, c' generally takes the maximum value in the input signal.

[0151] Step 4: get the data packet vector p i with byte weight, after it as input data into the data packet level BiTCN.

[0152] Step 5: BiTCN to input data packet vector p iEncoding is performed, and the processing flow is as follows:

[0153] Step 5.1: The BiTCN construction process of the data packet level is the same as that of the byte level, which is not repeated here. The data packet p i The inflation convolution formula at the data packet p

[0154]

[0155] Where c i represents the forward traffic data packet feature, η is the inflation factor, K is the size of the filter, and i-(K-k)η represents the previous direction information.

[0156] Step 5.2: First, the network weight is normalized, and then the residual module uses the activation function

[0157] LeakyReLU for nonlinear transformation, and the new forward traffic data packet feature is The formula is as follows:

[0158]

[0159] Where w3 represents the weight matrix, b3 represents the bias, and a is the coefficient.

[0160] To prevent overfitting, Dropout is used for regularization, and then the neurons of the hidden layer are randomly selected and deleted. The Dropout is set to 0.2.

[0161] Step 5.3: Repeat step 5.1 and step 5.2 once. Design a 1*1Conv to perform a simple transformation on x, so that the transformed x and H(x) can be added.

[0162] Step 5.4: Reverse the data packet feature set P = {p1, p2, …, p i ,…p s} that has been processed forward to obtain the reverse matrix P' = {p s ,…,p i ,…,p2, p1}, where s represents the number of data packets in the Flow or Session after segmentation. Put the reverse matrix into the reverse TCN model for training, so as to learn the reverse data packet feature c' i , the formula is as follows:

[0163] c' i = TCN(P') (formula 13)

[0164] Where the TCN function processing process is described in formula (1), and then c' iThe new reverse data packet features are obtained by using LeakyReLU activation function for nonlinear transformation The formula is as follows:

[0165]

[0166] Wherein, w4 represents the weight matrix, b4 represents the bias, and a is the coefficient.

[0167] Step 5.5: Connect the calculated forward feature vector And the reverse feature vector and To generate the feature vector of the data packet

[0168] Step 6: Introduce the data packet attention mechanism, calculate the weight distribution of the data packet, and give higher weight to important features, and finally obtain the time sequence feature vector f1.

[0169] Step 6.1: Input h i Into Embedding for mapping, respectively mapped to three different spaces, wherein the formula is shown in (15) (16) (17), W q ,W k And W v Represent randomly different space matrices, respectively obtain Query matrix Q={q i}, Key matrix K={k i}, Value matrix V={v i}.

[0170] Step 6.2: Multiply the mapping matrix Q and K to obtain h i The degree of association between Simi and other traffic feature vectors, Simi is calculated by Softmax function to obtain a normalized attention weight matrix a i , a i Indicates the weight of data packet i information, as formula (18) (19).

[0171] Step 6.3: Finally, the normalized weight matrix a i And v i Weighted summation is performed to update the feature representation of each data packet, and the network flow time sequence feature vector f1 is obtained, as formula (20).

[0172] Q=W q *h i (formula 15)

[0173] K=W k *h i (formula 16)

[0174] V=Wv *h i (Formula 17)

[0175]

[0176] f1=∑ i α i v i (Formula 20)

[0177] c′ is introduced to prevent the calculation result from overflowing. The value of c′ is generally the maximum value in the input signal.

[0178] CNN model section:

[0179] like Figure 3 As shown, the entire CNN model consists of two rounds of Conv layers, an Average Pooling layer, a Flatten layer, and Concat connections.

[0180] To further accelerate the model's fitting speed, this method adds a batch normalization layer before the first convolutional layer. The steps for training or processing data for a CNN model are as follows:

[0181] Step 1: Process the traffic dataset in .pcap format into an (N,T) two-dimensional numerical matrix format and use it as input to the CNN model. This represents two-dimensional stream data.

[0182] Where x nt A represents the t-th byte of the nth data packet. i The i-th data stream is represented by a two-dimensional numeric matrix of size (N, T).

[0183] Step 2: Conv layer: Convert the two-dimensional digital matrix A i When inputting into a CNN model, a 3x3 convolution kernel with 16 channels is first selected, and the LeakyReLU activation function is used for convolution to generate C. 11 Convolutional layer; then use a 2*5 convolutional kernel to generate C 12 Convolutional layers; finally, a 1x5 convolutional kernel is used to generate C. 13 Convolutional layer.

[0184] Step 3: Average Pooling Layer: The generated C... 11 C 12 C 13 The convolutional layer performs spatial scaling using 2x2 region average pooling, which calculates the average value from a 2x2 target region. The window moves at an interval of one element. The result of average pooling is then mapped to obtain S. 11 S12 S 13 Convolutional layer.

[0185] Step 4: Repeat steps 2 and 3, performing convolution operations with different kernel sizes and average pooling to generate C. 21 C 22 C 23 Convolutional layer results and S 21 S 22 S 23 Pooling layer results.

[0186] Step 5: Flatten layer: The obtained global average pooling layer result S... 21 S 22 S 23 Flattening is performed, which involves reducing the dimensionality of these three local feature matrices to obtain the corresponding one-dimensional spatial feature tensors 1d-tensor1, 1d-tensor2, and 1d-tensor3.

[0187] Step 6: Concat connection: The three spatial feature tensors from step 5 are fused to generate the stream space feature vector f2.

[0188] (3) Spatiotemporal feature vector fusion and classification, the implementation process of which is as follows:

[0189] Step 1: Concat information fusion of the network flow temporal feature vector f1 with byte and packet weights obtained by the L2-BiTCN model and the network flow spatial feature f2 obtained by the CNN model to obtain the spatiotemporal feature vector f.

[0190] Step 2: Then, pass f through the Softmax classifier to obtain the final traffic category probability P, as shown in the following formula:

[0191] P = Softmax(w c *f+b c ) (Formula 21)

[0192] Among them, w c Let b represent the weight matrix. c 'c' represents the bias, and 'c' represents the current label value.

[0193] Step 3: Calculate the gradient of the cross-entropy function Loss with respect to the weight parameters, and update the weight parameters along the gradient direction. Specifically, use stochastic gradient descent (SGD) to find the optimal solution for the parameters. The relevant formula is as follows:

[0194] Loss=-∑ c＝1 f c ln p c (Formula 22)

[0195]

[0196] wherein c is the label value, p c is the output probability P of the L2-BiTCN+CNN model calculation result, f c is the correct solution label. z represents the weight parameters that need to be updated, represents the gradient of the loss function with respect to z, η represents the learning rate, and <- represents updating the left value with the right value.

[0197] The application also proposes an SDN network abnormal traffic classification device based on double-layer attention and parallel fusion of space-time features, which can execute the above classification method. The device can be a computer device, a network device, or other controllers, etc.

[0198] The above is the implementation process of the entire SDN network abnormal traffic classification device and method based on double-layer attention and parallel fusion of space-time features. Subsequent testing and verification can be performed on public or private data sets that meet the specifications.

[0199] The above series of detailed descriptions are only specific descriptions of the feasible implementation modes of the application, and are not intended to limit the protection scope of the application. Any equivalent implementation modes or changes made without departing from the spirit of the application should be included in the protection scope of the application.

Claims

1. A SDN network abnormal traffic classification method based on double-layer attention and parallel fusion of space-time features, characterized in that, Comprise the following steps: S1: preprocessing the original traffic data, generating one-dimensional network traffic byte sequence and two-dimensional digital matrix, batch normalizing the network traffic sequence; S2: input the data processed by S1 into L2-BiTCN+CNN model for training or processing, L2-BiTCN+CNN model includes L2-BiTCN model and CNN model, L2-BiTCN model is used to capture the timing characteristics f1 of key bytes and data packets, and CNN model is used to obtain the spatial characteristics f2 of bytes in different data packets, The L2-BiTCN model of S2 comprises byte level and data packet level, the byte level comprises byte embedding layer, BiTCN layer and byte attention layer, the data packet level comprises data packet embedding layer, BiTCN layer and data packet attention layer; A batch normalization layer is added in front of the first convolutional layer, and weight normalization processing is adopted in the TCN layer, attention layer and fully connected layer; The steps of training or processing data by the L2-BiTCN model are as follows: Step 1: pass the byte sequence as input to the embedding layer in the byte level, represented as x it , where x it = b it e, b it represents the byte data in the i-th data packet, e∈R T*d represents the word vector matrix, T represents the number of bytes in the data packet, d represents the word vector dimension, X i = {x i1 , x i2 ,…, x it ,…x iT} represents the set of byte information word vectors of the i-th data packet; Step 2: input the word vector set X i = {x i1 ,x i2 ,…,x it ,…x iT} into the BiTCN layer in the byte level and perform batch normalization, and then the TCN encodes the input byte data word vector; Step 3: Introduce byte attention mechanism, calculate the weight distribution of bytes, give higher weight to important features, and obtain packet vector p with byte weight i ; Step 4: Obtain the data packet vector p with byte weights i After that, it is passed as input data into the BiTCN layer at the data packet level; Step 5: The BiTCN layer at the data packet level processes the input data packet vector p i Encoding is performed; Step 6: introduce the data packet attention mechanism, calculate the weight distribution of the data packet, give higher weight to important features, and finally obtain the timing characteristics f1; S3: fuse the timing characteristics f1 and the spatial characteristics f2 to generate a flow space feature vector f, and input it into a Softmax classifier to obtain the final flow category.

2. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 1, characterized in that, The specific process of S1 is as follows: S1.1: traffic segmentation stage: using the editcap tool in Wireshark software, mainly cutting the obtained original traffic data, which can be cut into multiple discrete network stream data according to Flow or Session; S1.2: traffic anonymization stage: the.pcap file after segmentation contains multiple data packets, this stage mainly extracts the payload data in the data packet, and reduces its influence on the traffic classification result by deleting the IP address; S1.3: traffic cleaning stage: this stage traverses the network stream data after anonymization, deletes duplicate data and data packets with payload data length of 0, and processes the data packets into a fixed length, greater than the length is truncated, and less than the length is padded with 0; S1.4: input format generation stage: this stage converts the fixed length stream data into a format, first, process the network stream data into a one-dimensional byte sequence, read the data in hexadecimal, and mark it for L2-BiTCN model, then convert the network stream data into a two-dimensional digital matrix, read the data in IDX format, and mark it for CNN model.

3. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 1, characterized in that, The specific process of step 2 is as follows: Step 2.1: Introducing the dilated convolution: Define the filter F = (f1, f2,..., f k ,...,f K ), representing filters of size 1, 2, k, K, respectively, and the dilated convolution formula at x it is: where c it denotes the feature of the forward network traffic, η is the dilation factor, K is the size of the filter, t-(K-k)η denotes the previous directional information, when η = 1, it is a normal convolution, when η = 2, it is sampling once every two input points of data; Step 2.2: add a residual module for identity mapping of cross-layer connection; Specifically as follows: Step 2.2.1 : The c treated in step 2.1 is obtained it After that, weight normalization is performed on the network weights. Step 2.2.2: Nonlinear transformation is performed using the activation function LeakyReLU, and the new forward network traffic feature vector is obtained The formula is as follows: Wherein, w1 represents weight matrix, b1 represents bias, and a is a coefficient, which can be understood as the gradient value given on the negative axis of the activation function; Step 2.2.3: use Dropout for regularization, randomly select neurons in the hidden layer and then delete them, and Dropout is set to 0.2; Step 2.3: Repeat steps 2.1 and 2.2 once, design a 1*1Conv to transform x, so that the transformed H(x) and x can be added; Step 2.4: Reverse the sequence of the word vector set X i ={x i1 ,x i2 ,…,x it ,…x iT} to get the reversed matrix X i ′={x iT ,…,x it ,…,x i2 ,x i1}, put the reversed sequence into the reversed TCN model for training or processing, and learn the reversed traffic feature c′ it , as shown in the formula c′ it = TCN(X′ i ) (Equation 3) Wherein, TCN function processing process is formula (1) described, then repeat steps 2.2 and 2.3, wherein step 2.2.2 is changed to c' it Using LeakyReLU activation function for nonlinear transformation, the new reverse network traffic feature vector obtained is The formula is as follows: Wherein, w2 represents the weight matrix, b2 represents the bias, and a is the coefficient, which can be understood as the gradient value given on the negative axis of the activation function; Step 2.5: The calculated forward feature vector and the reverse feature vector are concatenated to generate the feature vector of the data packet ​ 4. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 3, characterized in that, The specific process of step 3 is as follows: Step 3.1: Simultaneously set h it The input is mapped into the Embedding, which maps it to three different spaces, as shown in formulas (5), (6), and (7). q W k and W v Representing different random spatial matrices, we obtain the Query matrix Q = {q}. it }, Key matrix K = {k it Value matrix V = {v} it } Step 3.2: Map matrix Q with K dot product to get h it The degree of association between other data packet feature vectors Simi, Simi is calculated by a Softmax function to obtain a normalized attention weight matrix a it , a it represents the weight of the tth byte information in the data packet i, as shown in equations (8) and (9); Step 3.3: Finally, the normalization weight matrix a it with v it Weighted summation is performed to update the feature representation of each byte, and the data packet vector p i as formula (10); Q = W q h it (Formula 5) K = W k h it (Formula 6) V = W v h it (Formula 7) p i =∑ t α it v it ( Formula 10 ) where c' is introduced to prevent overflow of the calculation result, and c' generally takes the maximum value in the input signal.

5. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 3, characterized in that, The specific process of step 5 is as follows: Step 5.1: BiTCN processing procedure at packet level is same as BiTCN at byte level, packet p i The inflation convolution formula at p is as follows, where c i represents the forward flow packet feature, η is the inflation factor, K is the size of the filter, and i-(K-k)η represents the previous directional information; Step 5.2: First, the network weight is normalized, and then the residual module uses the activation function LeakyReLU for nonlinear transformation, and the new forward traffic packet features are obtained The formula is as follows: Wherein, w3 represents the weight matrix, b3 represents the bias, and a is the coefficient; Regularization using Dropout, randomly selecting neurons in the hidden layer and then deleting them, Dropout is set to 0.2; Step 5.3: Repeat steps 5.1 and 5.2 once, design a 1*1Conv to transform x, so that the transformed x and H(x) can be added; Step 5.4: Reverse the data packet feature set P = {p1, p2, …, p i ,…p s} that has been processed forward, to obtain the reverse matrix P' = {p s ,…,p i ,…,p2, p1}, where s represents the number of data packets in the Flow or Session after segmentation, and put the reverse matrix into the reverse TCN model for training or processing, thereby learning the reverse data packet features c i ', as follows: c′ i = TCN(P') (Equation 13) Wherein, the TCN function processing process is described in formula (1), and then c i Nonlinear transformation is performed using the LeakyReLU activation function, and the obtained new reverse data packet features are The formula is as follows: Wherein, w4 represents the weight matrix, b4 represents the bias, and a is the coefficient; Step 5.5: The calculated forward feature vector and the reverse feature vector are concatenated to generate the feature vector of the data packet ​ 6. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 5, characterized in that, The specific process of step 6 is as follows: Step 6.1: Input to Embedding for mapping, respectively, to three different spaces, where the formula is shown in (15) (16) (17), W i ,W q ,W k and W v represent randomly different space matrices, respectively, to obtain Query matrix Q = {q i}, Key matrix K = {k i}, Value matrix V = {v i}. Step 6.2: multiply the mapping matrix Q with K to get h i The degree of association between other traffic feature vectors Simi, Simi is calculated by a Softmax function to obtain a normalized attention weight matrix a i , a i represents the weight of the information of data packet i, such as formula (18) (19); Step 6.3: Finally, the normalization weight matrix a is calculated i with v i The weighted sum is performed to update the feature representation of each data packet, resulting in the timing feature f1, as in equation (20); Q = W q *h i (Formula 15) K = W k h i (Formula 16) V = W v h i (Formula 17) f1 =∑ i α i v i (Formula 20) Wherein, c' generally takes the maximum value in the input signal.

7. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 1, characterized in that, The CNN model includes two rounds of Conv layers and Average Pooling layers, Flatten layers and Concat layers, and a batch normalization layer is added in front of the first layer of convolutional layer, The steps of training or processing data of the CNN model are as follows: Step 1: Process the.pcap format traffic dataset into (N, T) two-dimensional digital matrix format, which is used as the data input of the CNN model, and use the matrix to represent two-dimensional flow data; where x nt represents the nth data packet tth byte, A i represents the two-dimensional digital matrix of the ith data stream, with a size of (N, T); Step 2: Conv layer: input the two-dimensional digital matrix A i into the CNN model, first select a 3*3 convolution kernel, channel number 16, and activation function LeakyReLU for convolution operation to generate C 11 convolution layer; then use a 2*5 convolution kernel to generate C 12 convolution layer; finally, use a 1*5 convolution kernel to generate C 13 convolution layer; Step 3: Average Pooling layer: The generated C 11 , C 12 , C 13 convolutional layer is reduced in space using 2*2 area Average pooling, that is, the average value is calculated from the target area of 2*2 size, the moving interval of the window is 1 element, and the result after the average pooling is mapped to obtain S 11 , S 12 , S 13 convolutional layer; Step 4: Repeat Step 2, Step 3, and again perform convolution operation with different kernel size and average pooling processing to generate C 21 、C 22 、C 23 convolution layer result and S 21 、S 22 、S 23 pooling layer result; Step 5: Flatten layer: flatten the global average pooling layer result S 21 , S 22 , S 23 Flatten flattening, that is, dimensionality reduction operation is performed on the three local feature matrices to obtain corresponding one-dimensional space feature tensors 1d-tensor1, 1d-tensor2, 1d-tensor3; Step 6: Concat connection: fuse the three one-dimensional spatial feature tensors in step 5 to generate spatial features f2.

8. The SDN network abnormal traffic classification method based on parallel fusion of double-layer attention and space-time features according to claim 1, characterized in that, The specific process of S3 is as follows: Step 1: Concat information fusion of time sequence features f1 with byte and packet weight obtained by L2-BiTCN model and spatial features f2 obtained by CNN model, to obtain a space-time feature vector f; Step 2: Then get the traffic category probability P through the Softmax classifier, the formula is as follows: P = Softmax(w c *f + b c ) (Equation 21) where w c represents a weight matrix, b c represents a bias, and c represents a current label value; Step 3: Calculate the gradient of the cross-entropy function Loss with respect to the weight parameter, update the weight parameter along the gradient direction, and use the stochastic gradient descent method (SGD) to find the optimal solution of the parameter, The relevant formula is as follows: Loss = -∑ c＝1 f c lnp c (22) where c is the label value, p c is the output probability P of the L2-BiTCN+CNN model calculation result, f c is the correct solution label. z represents the weight parameters that need to be updated, represents the gradient of the loss function with respect to z, η represents the learning rate, and ← represents updating the left value with the right value.

Images