A 5G network traffic anomaly detection method and system based on GYAC-LSTM

Abstract

The application provides a GYAC-LSTM-based 5G network traffic anomaly detection method and system, including: acquiring 5G network traffic data with labeled anomaly information, performing conditional filtering on the 5G network traffic data to obtain original training data; performing network packet analysis on the original training data to obtain feature values in the data and respectively generate respective candidate feature sets, performing feature selection on each candidate feature set based on GYAC to remove network traffic data in the candidate feature set and obtain target training data; inputting the target training data into an LSTM model to perform 5G network traffic anomaly detection, constructing a loss function to train the LSTM model based on a detection result and labeled anomaly information of the target training data, and obtaining a traffic anomaly detection model; and inputting to-be-detected 5G network traffic into the traffic anomaly detection model to obtain anomaly information of the to-be-detected 5G network traffic as a detection result.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of attack detection technology in mobile communication, and particularly relates to a method for constructing a GYAC-LSTM abnormality detection model oriented to 5G network traffic. BACKGROUND

[0002] The user plane of the 5G network uses user plane function (UPF) network element sinking, edge computing and other technologies and methods, so that it can carry low-latency, high-bandwidth traffic data and meet the customized needs of different users and vertical industries. Therefore, the 5G network traffic will grow in large scale. According to the mobility report released by Ericsson, the global mobile network data traffic reached about 108 EB per month from the second quarter of 2022 to the third quarter. With the growth of traffic, the zombie network formed by hundreds of millions of insecure devices and a large number of node connections will cause more powerful, more complex and more dangerous DDoS traffic attacks. For the vertical industry, the user plane traffic involves a large amount of control, operation, maintenance and other related instruction data. Once it is used by attackers, it will cause security risks such as production control disorder and business suspension. Therefore, it is urgent to carry out research on 5G network traffic anomaly detection technology.

[0003] In order to detect 5G network abnormal traffic, more features are usually obtained to avoid information loss. Therefore, the data set may contain a large number of irrelevant or redundant features, resulting in large traffic sample data size and high feature dimension. The traditional abnormality detection method uses all features for model training, which results in longer data processing time and more complex model. Therefore, feature selection is one of the important measures for abnormal traffic detection. Generally, the types of feature selection algorithms are divided into filtering methods, wrapping methods and embedded methods. The filtering feature selection method uses information gain, chi-square test, relief, etc. for important feature selection. This method has strong universality and low algorithm complexity, but the generated target feature set usually contains a large number of redundant features. The wrapping method usually uses recursive elimination and other methods to select a feature subset according to the model score. This method can usually select the optimal feature subset, but the complexity is high. The embedded method integrates the feature selection algorithm with the training model, such as using tree-based or penalty-based methods to automatically select features during the training process. However, this method also has high complexity, and how to combine the feature selection method with the model is a problem that needs to be considered.

[0004] In order to detect 5G network abnormal traffic, more features are usually obtained to avoid information loss, so there may be a large number of irrelevant or redundant features in the data set, resulting in large traffic sample data size and high feature dimension. The traditional abnormal detection method uses all features for model training, which results in longer data processing time and more complex model. Therefore, feature selection for massive high-dimensional 5G network traffic is an important measure for abnormal traffic detection and one of the research focuses of the present application.

[0005] In addition, 5G traffic anomaly detection is a long time series data analysis problem. The traditional traffic anomaly detection RNN technology performs well in non-long time series data anomaly detection, but the length of the 5G traffic time series is tens of thousands or even millions. Since the length of the time series is extremely large, the traditional RNN technology has the problems of gradient disappearance and gradient explosion when processing such long time series. Therefore, how to solve the defects of the traditional RNN technology is also one of the research focuses of the present application. SUMMARY

[0006] The purpose of the present application is to solve the problem of how to efficiently extract features from massive high-dimensional 5G network traffic in the prior art. A filtering feature selection method based on Gini index and cosine similarity is proposed. The important features are screened while the redundancy of the feature set is removed, which is suitable for processing large-scale traffic data. The present application proposes a GYAC-LSTM-based 5G network traffic anomaly detection method. First, the original data is preprocessed using conditional filtering. Then, statistical methods are used to obtain feature values in the data and generate a candidate feature set. Then, the GYAC (Gini Index, Year-on-year Decrease Index And Cosine Similarity) feature selection algorithm is used to screen important features and remove redundant features. The experimental feature dimensionality reduction uses the newly generated target feature subset as input for LSTM model training.

[0007] In view of the shortcomings of the prior art, the present application proposes a GYAC-LSTM-based 5G network traffic anomaly detection method, which includes:

[0008] The data preprocessing step obtains 5G network traffic data with labeled abnormal information, performs conditional filtering on the 5G network traffic data, and obtains original training data;

[0009] The feature selection step performs network packet analysis on the original training data, obtains feature values in the data, and generates respective candidate feature sets. The GYAC-based feature selection is used to remove network traffic data in the candidate feature set to obtain target training data;

[0010] The target training data is input into the LSTM model to perform 5G network traffic anomaly detection, and based on the detection result and the annotated abnormal information of the target training data, a loss function is constructed to train the LSTM model to obtain a traffic anomaly detection model;

[0011] In the anomaly detection step, the 5G network traffic to be detected is input into the traffic anomaly detection model to obtain the abnormal information of the 5G network traffic to be detected as the detection result.

[0012] The 5G network traffic anomaly detection method based on GYAC-LSTM, wherein the data preprocessing step comprises:

[0013] For the 5G network traffic data, first, a filtering method is used to clean the data and remove irrelevant data, then the cleaned traffic data is sorted in time sequence, the maximum length is set as Z, and the time interval is set as t, all data streams within t seconds are divided into a data stream subset flow t , and a statistical method is used to calculate the K-dimensional feature set F t of flow K,t , wherein F K,t ={f 1,t ,f 2,t ,...,f K,t}, all time interval t feature vectors are arranged, and finally a data set D K,T of a type of traffic is obtained, wherein D K,T ={F K,1 ,F K,2 ,...,F K,T};

[0014] The 5G network traffic anomaly detection method based on GYAC-LSTM, wherein the feature selection step comprises: using the Gini index difference and the same ratio reduction index to represent the contribution to the classification of two types of traffic data, calculating the contribution of non-same type data features in turn and summing and ranking to obtain the importance ranking of traffic features; using the cosine similarity to represent the correlation between different features in the same type of traffic data, and converting it into the distance between features, then selecting the features with high correlation coefficient and importance coefficient according to the redundancy threshold and importance threshold, and finally taking the union of the selected features of each type of traffic to obtain the target training data;

[0015] The 5G network traffic anomaly detection method based on GYAC-LSTM, wherein the feature selection step comprises:

[0016] For a three-dimensional data set D N×K×T , wherein N represents the number of data types, K represents the dimension of the feature, T represents the length of the data, and it is assumed that If a certain type of traffic data is represented, then The feature set is represented as in The Gini index measures the impurity or uncertainty coefficient of a certain feature, as shown in equation (7):

[0017]

[0018] In the formula Representation of features The probability of different values ​​in the eigenvalues ​​is represented by the Gini index, which ranges from 0 to 1. Let n1, n2 ∈ N, and use the Gini difference to represent the eigenvalues. Data The contribution coefficient for classification is shown in equation (8):

[0019]

[0020] Represents eigenvalues The mean value for the total length T is shown in equation (9) below:

[0021]

[0022] The characteristic is represented by the year-on-year decrease index. Data The contribution coefficient of the classification is shown in equation (10) below:

[0023]

[0024] In the formula The values ​​are between 0 and 1. The contribution coefficient one and contribution coefficient two are assigned different weights and summed, and used together as the feature. The total contribution of the two types of traffic data is distinguished as shown in the following formula (11):

[0025]

[0026] Through calculation The contribution of traffic data to other traffic data is calculated and summed to obtain the features. The feature importance coefficient is shown in equation (12) below:

[0027]

[0028] Using cosine similarity to calculate the correlation between features, let k1,k2∈K, then and The correlation coefficient is The distance between the two coefficients is shown in equation (14) below:

[0029]

[0030] N×K×T

[0031] The GYAC-LSTM-based 5G network traffic anomaly detection method, wherein the training step comprises:

[0032] The input layer of the LSTM model performs normalization processing on the features of the target training data, as shown in the following formula (15) and formula (16):

[0033]

[0034]

[0035] In the formula, X represents the input original feature value; respectively represent the minimum value and the maximum value in the feature set; V max , V min respectively represent the maximum value and the minimum value of the mapping interval; represents the normalized result after scaling by proportion; let the total time step of data be T, each step contains K-dimensional features, and the input is represented as Input={X 1,K ,X 2,K ,...,X T,K}, each training includes T time steps, each time step corresponds to an LSTM unit, and K-dimensional feature data is processed in each unit, and finally the prediction result is input into a fully connected layer; the output dimension of the fully connected layer is the type number of traffic data, assuming N, then the output value is Output={Y1,Y2,...,Y N}, in order to correspond the output of the fully connected layer to the probability of predicting a certain category, the softmax function is used to map the output to between 0 and 1, and ensure that all outputs sum to 1, as the probability value for classification under the current input, let y i =[y1,y2,...,y N ​​​​​​​​], its y i The output probability value after the softmax function is shown in the following formula (17);

[0036]

[0037] In the formula S i The probability value of the model prediction is a certain type, and the category corresponding to the maximum probability is taken as the detection result.

[0038] The application also provides a 5G network traffic anomaly detection system based on GYAC-LSTM, which comprises:

[0039] A data preprocessing module is configured to obtain 5G network traffic data with labeled anomaly information, perform conditional filtering on the 5G network traffic data, and obtain original training data.

[0040] A feature selection module is configured to perform network packet analysis on the original training data, obtain feature values in the data and generate respective candidate feature sets, perform feature selection on the candidate feature sets based on GYAC to remove network traffic data in the candidate feature sets, and obtain target training data.

[0041] A training module is configured to input the target training data into an LSTM model, perform 5G network traffic anomaly detection, construct a loss function based on a detection result and labeled anomaly information of the target training data, train the LSTM model, and obtain a traffic anomaly detection model.

[0042] An anomaly detection module is configured to input 5G network traffic to be detected into the traffic anomaly detection model, and obtain anomaly information of the 5G network traffic to be detected as a detection result.

[0043] The 5G network traffic anomaly detection system based on GYAC-LSTM, wherein the data preprocessing module comprises:

[0044] For the 5G network traffic data, a filtering method is first used to clean the data and remove irrelevant data, and then the cleaned traffic data is sorted in time sequence, the maximum length is set as Z, and the time interval is set as t, all data streams within t seconds are divided into a data stream subset flow t A statistical method is used to calculate the K-dimensional feature set F t of flow K,t , wherein F K,t ={f 1,t ,f 2,t ,...,f K,t}, all time interval t feature vectors are arranged, and finally a data set D K,T of a type of traffic is obtained, wherein D K,T= {F K,1 ,F K,2 ,...,F K,T};

[0045] The GYAC-LSTM-based 5G network traffic anomaly detection system, wherein the feature selection module comprises: using the Gini index difference and the same ratio reduction index to represent the contribution to the classification of two types of traffic data, sequentially calculating the contribution of non-same type data features and summing and ranking to obtain the importance ranking of traffic features; using the cosine similarity to represent the correlation between different features in the same type of traffic data, and converting it into the distance between features, then selecting the features with high correlation coefficient and importance coefficient according to the redundancy threshold and the importance threshold, and finally taking the union of the selected features of each type of traffic to obtain the target training data;

[0046] The GYAC-LSTM-based 5G network traffic anomaly detection system, wherein the feature selection module comprises:

[0047] For a three-dimensional data set D N×K×T , wherein N represents the number of data types, K represents the dimension of the feature, T represents the length of the data, and let represent a certain type of traffic data, then The feature set of is represented as wherein The Gini index is used to measure the impurity or uncertainty coefficient of a certain feature, as shown in formula (7):

[0048]

[0049] In the formula, P represents the probability of different values in the feature , and the Gini index of the feature value is between 0 and 1; let n1, n2 ∈ N, and use the Gini difference to represent the contribution coefficient of the feature to the classification of data , as shown in formula (8):

[0050]

[0051] The mean value of the feature value under the total length T is represented as formula (9) as follows:

[0052]

[0053] The same ratio reduction index is used to represent the feature to the classification of data , as shown in formula (10):

[0054]

[0055] wherein The contribution degree coefficient one and the contribution degree coefficient two are taken different weights and summed up together as the feature The total contribution degree of distinguishing two types of flow data is shown in the following formula (11):

[0056]

[0057] The contribution degree of the flow data and other flow data is calculated The contribution degree of the flow data and other flow data is calculated The feature importance coefficient of the feature is shown in the following formula (12):

[0058]

[0059] The correlation between the features is calculated using the cosine similarity, and the correlation coefficient of k1, k2 ∈ K is The distance between the two coefficients is shown in the following formula (14):

[0060]

[0061] All distances between the feature and other features are calculated in sequence; the important feature selection is performed according to the importance coefficient and the distance coefficient of the feature According to the preset redundancy threshold m1, the proportion of the number of features farthest from the feature According to the preset importance threshold m2, the proportion of the number of features farthest from the feature is determined, and the proportion of the number of features farthest from the feature is determined, and the proportion of the number of features farthest from the feature The candidate feature subset of the feature is obtained, and the feature subsets of the data of each type are taken union to obtain D N×K×T The target training data.

[0062] The 5G network flow anomaly detection system based on GYAC-LSTM, wherein the training module comprises:

[0063] The input layer of the LSTM model performs normalization processing on the features of the target training data, as shown in the following formula (15) and formula (16):

[0064]

[0065]

[0066] wherein​​ represents input original feature values; respectively represent the minimum value and the maximum value in the feature set; max , V min respectively represent the maximum value and the minimum value of the mapping interval; represents a normalized result after scaling; assuming that the total time step of data is T, each step contains K-dimensional features, and the input is represented as Input = {X 1,K ,X 2,K ,...,X T,K}, each training includes T time steps, each time step corresponds to an LSTM unit, K-dimensional feature data is processed in each unit, and finally the prediction result is input into a full connection layer; the output dimension of the full connection layer is the type number of traffic data, assuming that the output value is Output = {Y1, Y2,..., Y N}, in order to correspond the output of the full connection layer to the probability of predicting a certain category, a softmax function is used to map the output to between 0 and 1, and all outputs are guaranteed to be 1, as the probability value of classification under the current input, assuming that y i = [y1, y2,..., y N ], the output probability value of y i after the softmax function is shown in the following formula (17);

[0067]

[0068] In the formula, S i represents the probability value of the model predicting a certain type, and the category corresponding to the maximum probability is taken as the detection result.

[0069] From the above scheme, it can be known that the present application has the following advantages:

[0070] The application provides a 5G network traffic anomaly detection method based on GYAC-LSTM, introduces Gini index, same reduction index and cosine similarity for filter type feature selection, wherein the Gini index pays more attention to the discrimination degree of different samples, and therefore can better mine the differences between different features. The same reduction index can better reflect the changes of features in the scale. The cosine distance has better performance when calculating features with large scale differences and sparse sample data points, and is suitable for processing high-dimensional data. Further considering the time sequence characteristics of the features, the advantages of LSTM in analyzing time sequence data are used, the feature subset after dimension reduction is used for LSTM network training, and the accuracy of 5G network anomaly traffic detection is improved. In the experimental analysis, a plurality of 5G network abnormal traffic data sets are generated by using a 5G network experimental platform, and are used for analysis and verification of the detection method. The experimental results show that the method can greatly reduce the feature dimension, and the accuracy of abnormal traffic identification can be kept at 93% to 98%. Compared with similar algorithms, the training time cost is saved by 8% to 44%.

[0071] In addition, in order to solve the problem that the 5G network traffic with long time sequence characteristics has gradient explosion and gradient disappearance in the training process of the traditional anomaly detection CNN technology, causing the reduction of the anomaly detection efficiency, a 5G network traffic anomaly detection method based on Gini index and cosine similarity (GIACS) and LSTM network is provided. The method can greatly reduce the feature dimension, and the accuracy of abnormal traffic identification can be kept at 93% to 99% when the feature dimension is only 25%, 50% and 75% of the total feature set. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 It is a filter type method flowchart;

[0073] Figure 2 It is a wrapped method flowchart;

[0074] Figure 3 It is an embedded method flowchart;

[0075] Figure 4 It is an LSTM unit structure diagram;

[0076] Figure 5 It is a 5G traffic anomaly detection architecture diagram based on GYAC-LSTM;

[0077] Figure 6 It is a data preprocessing flowchart;

[0078] Figure 7 It is a GYAC feature selection algorithm flowchart;

[0079] Figure 8 LSTM model graph;

[0080] Figure 9 5G network traffic attack schematic;

[0081] Figure 10 Initiating 5G DoS Hulk Attack schematic;

[0082] Figure 11 Normal UE registration failure schematic;

[0083] Figure 12 Normal UE registration success after stopping attack schematic;

[0084] Figure 13 Initiating 5G DoS Slowhttp Attack schematic;

[0085] Figure 14 Service unavailable schematic;

[0086] Figure 15 System error schematic;

[0087] Figure 16 Initiating 5G DDoS Bonesi Attack schematic;

[0088] Figure 17 Traffic data when no attack initiated schematic;

[0089] Figure 18 Traffic data after attack starts schematic;

[0090] Figure 19 5G DoS Hulk Attack important feature ranking graph;

[0091] Figure 20 5G DoS Slowhttp Attack important feature ranking graph;

[0092] Figure 21 5G DDoS Bonesi Attack important feature ranking graph;

[0093] Figure 22 Normal traffic important feature ranking graph;

[0094] Figure 23 Feature dimension reduction rate under different thresholds schematic;

[0095] Figure 24 Detection performance and training time under different feature dimensions graph;

[0096] Figure 25Performance proportion and performance-cost benefit graph under different feature dimensions;

[0097] Figure 26 Detection performance and training time graph under different feature dimensions. DETAILED DESCRIPTION

[0098] The inventor found that the defect in the prior art is caused by not considering the characteristics of massive high-dimensional and long time series of 5G network traffic. The reason for not considering it may be that the characteristics of massive high-dimensional and long time series of 5G network traffic are not linked together. The inventor found that the defect can be solved by introducing Gini index, same reduction index and cosine similarity filtering feature selection method, among which Gini index pays more attention to the discrimination of different samples, so it can better mine the differences between different features. The same reduction index can better reflect the change of the feature in the scale. Cosine distance has better performance when calculating the features with large scale difference and sparse sample data points, and is suitable for high-dimensional data processing. Further considering the time sequence characteristics of the features, the advantages of analyzing time sequence data by using LSTM are utilized, and the reduced feature subset is used for LSTM network training, thereby improving the accuracy of 5G network abnormal traffic detection.

[0099] In order to realize the above technical effects, the application includes the following technical key points:

[0100] Key point 1, in view of the problem that the 5G network traffic data is characterized by massive high dimension and long time series, which leads to long time consumption and poor detection performance of abnormal detection data; the application provides a 5G traffic anomaly detection method and architecture based on GIACS-LSTM, which has two main functional components, namely: data preprocessing and feature selection function, and 5G traffic anomaly detection function.

[0101] Key point 2, for the data preprocessing and feature selection part mentioned in key point 1, a 5G network traffic feature selection method for massive high-dimensional data is provided; the important features of 5G network traffic are screened out, and irrelevant features and redundant features are removed, thereby reducing the dimension of the traffic sample.

[0102] Key point 3, for the data preprocessing part in key point 2, the data preprocessing is performed on the 5G original traffic data; the data is cleaned using the filtering condition, irrelevant data is removed, and the data character features are converted into digital features.

[0103] Key point 4, for the data feature selection part in key point 2, a GIACS-based feature selection algorithm is used for feature selection of the 5G network traffic data set obtained after data preprocessing; while screening the important features for the anomaly detection model and removing redundant features, the dimensionality reduction of high-dimensional traffic data is realized, the training data size of the anomaly detection model is reduced, and the model training speed is accelerated;

[0104] Key point 5, for the GIACS-based feature selection algorithm mentioned in key point 4, the Gini index difference and the same ratio reduction index are used to represent the contribution to the classification of 5G two-class traffic, and the cosine similarity is used to represent the correlation between different features in 5G traffic data; this method can obtain the traffic feature importance ranking of 5G one-class traffic, the correlation between different features in the same traffic data, and select the features with high correlation coefficient and importance coefficient according to the importance threshold and redundancy threshold to obtain the target feature subset;

[0105] Key point 6, for the use of Gini index difference and same ratio reduction index to represent the contribution to the classification of 5G two-class traffic mentioned in key point 5, first define the Gini index of a feature in 5G traffic, and then obtain the Gini difference to represent the contribution coefficient one of the feature in distinguishing two-class traffic data, then calculate the feature mean, and then obtain the same ratio reduction index to represent the contribution coefficient two of the feature in different data types; the sum of the two different weights of the contribution coefficient one and the contribution coefficient two is taken as the total contribution of the feature in distinguishing two-class traffic, and then the feature importance coefficient is calculated, the larger the coefficient, the higher the contribution of the feature to all data classification;

[0106] Key point 7, for the use of cosine similarity to represent the correlation between different features in 5G traffic data mentioned in key point 5, first define the correlation coefficient between different features, and then convert it into the distance between two coefficients for easy calculation and sorting; this method can limit the distance between features to be greater than zero, which is convenient for feature distance calculation and sorting;

[0107] Key point 8, for the redundancy threshold and importance threshold mentioned in key point 5, the redundancy threshold is the proportion of the number of features farthest from the feature, and the importance threshold is the proportion of the number of features with high importance coefficient after removing redundant features according to the redundancy threshold; important feature selection according to the importance coefficient and distance coefficient of the feature can obtain the optimal feature set of the original data set, this method not only effectively reduces the feature dimension, but also dynamically generates a feature subset by controlling two thresholds to meet the needs of different scenarios;

[0108] Key point 9, for the 5G network traffic attack case under the 5G network experimental environment used by the application, the security of the UPF network element is usually lowered to the unattended base station or the edge cloud; since the attacker targets the less secure UPF network element, the attacker uses or hijacks the above scheme, the advantages of the application are that three kinds of DoS attack schemes can be implemented to threaten the security of 5GC and other important network elements.

[0109] In order to make the above-mentioned features and effects of the application more clear and easy to understand, the following embodiments are described in detail below, and the accompanying drawings are described as follows.

[0110] Feature selection method:

[0111] Network traffic contains a large number of related and redundant features, which significantly reduces the performance of large-scale data-driven network anomaly detection. Therefore, in the data preprocessing process, important features for the model can be screened and redundant features can be removed, which has the advantages that: unimportant and redundant features in the feature set can be eliminated, the training data size is reduced and the model training speed is accelerated; by reducing the feature dimension, the model overfitting phenomenon can be avoided. Feature selection methods can generally be divided into filter methods, wrapper methods and embedded methods.

[0112] (1) Filter method

[0113] The filter method is to rank by calculating the attribute score of the feature and the feature, realize the screening and selection of the feature, and this method is irrelevant to the subsequent feature learning process. Generally, the attributes of the feature include divergence and correlation. The divergence refers to the purity, uncertainty and information amount contained in the feature, which is mainly represented by Gini index, information entropy, etc. The correlation refers to the association and similarity between features, which is mainly represented by cosine distance, Euclidean distance and Pearson correlation coefficient. According to the sorting result of the attribute score, the threshold value is set to generate the target feature subset that meets the requirements. The main filter feature selection methods at present include information gain, variance threshold, chi-square test, relief, etc. The process of the filter feature selection method is as shown in Figure 1

[0114] (2) Wrapper method

[0115] The wrapper method is a feature selection method that takes the performance of the learner as the evaluation criterion, and its purpose is to generate the feature set that is most beneficial to the performance of the learner. The main idea is to recursively construct the feature set by adding or deleting features and input it into the learner until all feature subsets are traversed, and the target feature subset with the best learning performance is obtained, so it can be regarded as a kind of greedy algorithm for finding the best subset, and the main methods at present include genetic algorithm, particle swarm algorithm, evolutionary algorithm, differential algorithm, etc. The process of the wrapper feature selection method is as shown in​Figure 2 as shown.

[0116] (3) Embedded method:

[0117] The embedded method is to combine the feature selection process with the learner training process, so that the learner automatically performs feature selection during the training process. The main idea of this method is to use some special models to fit the data, and then use the evaluation properties of the model itself as the evaluation index, and then perform feature selection based on the wrapping idea. The embedded feature selection method mainly uses feature selection based on penalty terms, feature selection based on tree models, etc. The flow of the embedded feature selection method is as shown in Figure 3

[0118] The wrapping method can make the performance of the learner better, but the selected feature subset has poor universality, and needs to be reselected according to the learning algorithm, and the calculation resource and memory resource consumption of the algorithm is usually large. For the embedded method, how to integrate the feature selection process into different learners is a problem to be solved, and the algorithm also faces the situation of large calculation amount and complex calculation process. The filtering method has strong universality and low algorithm complexity, and is suitable for large-scale data sets, so in practical application, the filtering method is more widely used. The present application mainly researches and designs the filtering feature selection method.

[0119] LSTM network:

[0120] In the aspect of anomaly detection, deep learning technology is widely used because it can detect computer network threats and anomalies in various applications. One kind of artificial neural network with sequential structure, RNN, can theoretically well solve the problem of time series. The core of this network is to use special memory units that can save the state of the previous moment, so that the output of the hidden layer of RNN at each moment is transmitted to the next moment. Therefore, the network at each moment will retain a certain historical information from the previous moment, and combine the network state at the current moment and transmit it to the next moment. 5G network traffic is a long time series with sequential structure.

[0121] However, RNN has the problems of gradient disappearance and gradient explosion when processing long time series. This is because the derivative of the activation function will be multiplied during parameter transmission. When the weight is less than 1 or the weight is very large, it is almost inevitable to cause the phenomenon of gradient disappearance and gradient explosion. In order to solve this defect and meet the demand of 5G network traffic long time series anomaly detection, LSTM network is introduced.

[0122] ​As a special RNN network, LSTM is mainly used to solve the problems of gradient disappearance and gradient explosion in long sequence training process, and has better performance in long time sequence analysis. LSTM considers the long-term dependence relationship between distant parameters, and uses cell state to replace the neurons in the hidden layer. Each cell state is protected and controlled by three gates, namely the forget gate, the input gate and the output gate. The forget gate controls the information to be discarded according to formula (1), the input gate determines the information to be updated according to formula (2), the output gate is used to update the state of the cell according to formula (3), the cell state or long-term memory is represented according to formula (4), the short-term memory is represented according to formula (5), and the candidate state is represented according to formula (6). x t represents the current input, tanh represents the hyperbolic tangent activation function, and σ represents the Sigmoid activation function. The basic structure of LSTM is shown in Figure 4 .

[0123] However, due to the complex structure of LSTM network itself, the training is time-consuming, and each LSTM cell means 4 fully connected layers (MLP). If the time span of LSTM is long or the network is deep, the calculation amount will be large, which will cause a lot of time consumption. The 5G network traffic feature selection algorithm based on GYAC-LSTM proposed in this paper can reduce the input traffic feature dimension while ensuring high abnormal detection rate, and the experimental results show that when the test traffic feature dimension is reduced by 75%, the abnormal detection accuracy and F1 value can still remain at about 90%, and the training time is reduced by about 15%, thereby reducing the calculation amount of LSTM network and saving the calculation time, and to some extent, alleviating the shortage of large calculation amount and time consumption of LSTM network.

[0124] The main three stages inside LSTM are the forgetting stage, the memory selection stage and the output stage. The forgetting stage of LSTM is to selectively forget the information in the cell state C t-1 transferred from the previous node, which is realized by the forgetting gate f t , so that each value in C t-1 is between 0 and 1, where 0 means completely discarded and 1 means completely retained. The memory selection stage is to selectively remember the input of the current node, which is realized by the input gate i t , so that each value in C t is also between 0 and 1. Adding f t and i t can get the long-term memory C t of the next stage.The output stage is to control which information is output as the current state, and the process first uses tanh to process the current cell state to get a value between -1 and 1, and then passes through the output gate o t The information required for multiplication output.

[0125] f t = sigma (W f [h t-1 ,x t ]+b f ) (1)

[0126] i t = sigma (W i [h t-1 ,x t ]+b i ) (2)

[0127] o t = sigma (W o [h t-1 ,x t ]+b o ) (3)

[0128]

[0129] h t = o t tanh (C t ) (5)

[0130]

[0131] Using the above internal structure of LSTM, the state output is controlled by the gating unit, so that the information that needs to be remembered for a long time can be retained and the unimportant information can be discarded, and the problem of long time sequence analysis task is solved.

[0132] Abnormality detection method:

[0133] Model architecture:

[0134] With the popularization and application of 5G network, network traffic also presents explosive growth, and 5G network traffic data is characterized by mass high dimension and long time sequence, which leads to long time consumption and poor detection performance of abnormality detection data. In view of this problem, the present application provides a 5G network traffic abnormality detection method based on GYAC-LSTM algorithm, and the overall architecture is as shown in Figure 5 The architecture has two main functional components, namely: data preprocessing and feature selection function, and 5G traffic abnormality detection function.

[0135] The data preprocessing and feature selection function mainly solves the problem of long time consumption caused by the difficulty of efficiently processing 5G massive high-dimensional data by removing unimportant and redundant features in the feature set through feature selection. The data preprocessing and feature selection function is divided into data preprocessing, statistical function, and feature selection based on GYAC. First, the conditional filtering method is used, such as using the filter in the network packet analysis tool Wireshark to set the filtering condition as the corresponding ip and protocol, to preprocess the original traffic, remove irrelevant data, and divide it into original training set traffic data and original test set traffic data. Each data stream in the original traffic is labeled with a label, and the label content is normal data and attack data containing attacks. Then, the Wireshark statistical function is used to obtain the feature values in the data and generate the candidate feature set of the target training feature subset and the target test feature subset, respectively. Finally, the GYAC-based feature selection algorithm is used to screen important features and remove redundant features, and the target training and test feature subsets are obtained by dimension reduction.

[0136] The 5G traffic anomaly detection function mainly solves the problem of poor anomaly detection performance caused by gradient disappearance and gradient explosion in the long training process of 5G long time series by using cell state to replace the neurons in the hidden layer, considering the long-term dependence between 5G traffic long-distance parameters. The anomaly detection function includes the LSTM model and performance evaluation. The newly generated target training feature subset is input into the LSTM model after normalization processing for training. Then, the target test subset data is input into the trained LSTM model for anomaly detection, and finally the performance is evaluated according to the detection and classification results.

[0137] Data preprocessing:

[0138] As shown in Figure 6 , for collecting original traffic data, first, use the filtering method to clean the data and remove irrelevant data. Then, sort the data stream d of the original data in chronological order, set its maximum length as Z, and the time interval t, divide all data streams within t seconds into a data stream subset flow t , and use the statistical method to calculate the K-dimensional feature set F t of flow K,t , where F K,t = {f 1,t , f 2,t ,..., f K,t}, arrange all time interval t feature vectors, and finally get a data set D K,T of a type of traffic, where D K,T = {F K,1 , F K,2 ,..., F K,T}, and the process is as follows Figure 6As shown.

[0139] Feature selection:

[0140] The application proposes a feature selection algorithm based on GYAC, as shown Figure 7 Firstly, by studying the statistical properties of the features, the uncertainty difference and the relative size difference between the features are comprehensively considered, so the Gini index difference and the same ratio reduction index are used to represent the contribution to the classification of two types of flow data, the contribution of non-same type data features is calculated in turn and summed up to generate the importance ranking of the flow feature, in order to reduce the redundancy between important features, the cosine similarity is used to represent the correlation between different features in the same type of flow data, and the distance between the features is converted, then the features with high correlation coefficient and importance coefficient are selected according to the redundancy threshold and importance threshold, finally the selected features of each type of flow are combined to obtain the target feature subset, the specific algorithm is as follows:

[0141] For a three-dimensional data set D N×K×T , where N represents the number of data flow types, the data flow types include: normal flow data, flow data containing 5G DoS Hulk Attack, 5G DoS Slowhttp Attack and 5G DDoSBonesi Attack. K represents the dimension of the feature, T represents the length of the data, and set represents the flow data of a certain data flow type, then D n K,T The feature set of D , where n in F represents the type of data flow, and the dimension and length of the flow data are various, the data dimension K takes 1~K dimension, and the data length takes 1~T length. First, define the Gini index G to measure the impurity or uncertainty coefficient of a certain feature, as shown in formula (7).

[0142]

[0143] In the formula, P represents the probability of different values in the feature , and the Gini index of the feature value is between 0 and 1, the closer to 0 indicates lower uncertainty, and vice versa, the closer to 1 indicates higher uncertainty. In order to know whether the feature can effectively distinguish two types of flow data, set n1,n2∈N, and use the Gini difference to represent the contribution coefficient of the feature to the classification of data , as shown in formula (8).

[0144]

[0145] Set representing the eigenvalue The average value under the total length T, as shown in equation (9).

[0146]

[0147] To know the characteristics The relative size in different data types to distinguish two types of traffic data, using the same reduction index to represent the characteristics The data The contribution coefficient of classification II, as shown in equation (10).

[0148]

[0149] In the formula The value is between 0 and 1, the closer to 0 indicates the smaller the difference between the eigenvalues, and vice versa, the closer to 1 indicates the larger the difference between the eigenvalues, and can better distinguish different types of traffic data. Take different weights of contribution coefficient I and contribution coefficient II and sum them up, which are used as characteristics The total contribution of distinguishing two types of traffic data, as shown in equation (11).

[0150]

[0151] By calculating The contribution of traffic data and other traffic data and summing them up, the characteristic importance coefficient of the characteristics The larger the coefficient indicates The higher the classification benefit for all data, as shown in equation (12).

[0152]

[0153] The characteristic importance coefficient algorithm is shown in Table 1.

[0154] Table 1 Characteristic importance coefficient algorithm

[0155]

[0156] To remove redundant features in the feature set, use cosine similarity to calculate the correlation between different features. The cosine similarity is the cosine value of the angle between the features, so the value is between -1 and 1, the closer to 0 indicates the lower the correlation between the features, and vice versa, the closer to 1 indicates the higher the correlation, set k1, k2 ∈ K, then And The correlation coefficient of and as shown in equation (13).

[0157]

[0158] For easy calculation and sorting, use represents the distance of two coefficients, as shown in equation (14).

[0159]

[0160] Therefore, the distance between the features is limited to d>0, and f n k,T All distances with other features, the feature distance coefficient algorithm process is shown in Table 2.

[0161] Table 2 Feature Distance Coefficient Algorithm

[0162]

[0163] According to the importance coefficient and the distance coefficient of the feature , the important feature selection is first defined as the redundancy threshold m1, that is, the number of features farthest from the feature occupies a certain percentage, and the importance threshold m2, that is, after removing the features redundant to the feature , the number of features with the highest importance coefficient occupies a certain percentage according to m1. Then, the candidate feature subset is calculated in turn, and the feature subsets of various data are taken and collected, that is, the optimal feature set D N×K×T is obtained. This method not only effectively reduces the feature dimension, but also dynamically generates the feature subset by controlling m1 and m2 to meet the needs of different scenarios.

[0164] LSTM model design

[0165] The selected target feature subset will be used as input to use the LSTM model for abnormal traffic data detection and classification. Its structure is mainly composed of three parts, namely input layer, LSTM unit and full connection layer, and its structure is shown in Figure 8 .

[0166] In order to speed up the network learning speed and avoid the problem of unable to converge caused by singular sample data, the input feature data is normalized in the input layer, as shown in equation (15) and equation (16).

[0167]

[0168]

[0169] In the formula, x represents the input original feature value; represents the minimum and maximum values in the feature set, respectively; V max , V min represent the maximum and minimum values of the mapping interval, which are usually set to 1 and 0; The normalized result after scaling is represented. Assuming that the total time step of data is T, each step contains K-dimensional features, and the input is represented as Input={X 1,K ,X 2,K ,...,X T,K}, so T time steps are needed for each training, each time step corresponds to an LSTM unit, and K-dimensional feature data is processed in each unit, and finally the prediction result is input into the full connection layer. The output dimension of the full connection layer is the type number of traffic data, assuming N, then the output value is Output={Y1,Y2,...,Y N}, in order to correspond the output of the full connection layer to the probability of predicting a certain category, the softmax function is used to map the output to between 0 and 1, and ensure that all outputs are 1, as the probability value of classification under the current input, assuming y i =[y1,y2,...,y N ], the output probability value of y i after the softmax function is shown in equation (17).

[0170]

[0171] In the formula, S i represents the probability value of the model predicting normal data type or abnormal type containing attack.

[0172] Experimental analysis

[0173] The 5G network experimental platform built by the application is used for 5G network abnormal traffic data set generation, and is used for verification and analysis of abnormal detection technology. This section first introduces the 5G network experimental environment used, then designs 5G network abnormal traffic attack cases, and verifies and collects data sets in the built experimental environment, and finally uses the data set to verify and analyze the 5G network traffic anomaly detection technology based on GYAC-LSTM proposed by the application.

[0174] 5G network experimental environment

[0175] The application uses a built 5G network experimental platform to verify experimental cases. The 5G network experimental platform is built through simulation software and test tools. The experimental tools mainly use simulation UE, simulation RAN, 5GC, Postman signaling test software, Wireshark packet capture software and Iperf network test software. The overall architecture of the 5G network experimental platform mainly includes an interaction module, a 5G network module and a test module. The interaction module is used for 5G network configuration policy issuing, including simulation UE registration and authentication key, UE access interface, simulation RAN interface, UE subscription in 5GC, etc. The 5G network module is deployed in two virtual machines. The simulation UE and the simulation RAN are deployed in virtual machine 1 using the UE RANSIM software, and the 5GC is deployed in virtual machine 2 using the Free5gc. The Free5gc uses a service-based architecture and realizes the functions of network elements including AMF, SMF, UDM, UDR, NSSF, PCF, AUSF, NRF, UPF, etc. The interface information of each network element can be set through a configuration file. The running principle of the 5G network module is the same as that of the real 5G network environment. The test module is mainly used for network signaling testing, traffic collection, network state monitoring, etc. and is composed of packet capture tools, network test tools, etc.

[0176] 5G network traffic attack case

[0177] The combination of 5G network and Internet of Things will lead to hundreds of millions of insecure devices and a large number of node connections, making it possible to build a large-scale botnet. The botnet formed by 5G mass Internet of Things devices will provide more powerful, more complex and more harmful DDoS traffic attacks. In the 5G network architecture, the UPF network element is responsible for the routing and forwarding of user plane data related functions, and uses N3, N4, N6 and other interfaces to interact with other network elements. To meet the delay requirement, it is usually sunk to the side of the unattended base station or near the edge cloud, resulting in low security of the UPF network element. Once exploited or hijacked by attackers, it will pose a serious security threat to the 5GC and other important network elements, and face the danger of large-scale network paralysis, as shown in FIG. 1. According to the architecture of the 5G network and the used protocols, the application designs three attack schemes, including two 5G DoS Hulk Attack and 5G DoS Slowhttp Attack launched against the defects of the HTTP protocol used in the 5GC, and 5G DDoS Bonesi Attack against the UPF network element. The experimental environment uses the 5G network experimental platform introduced above. Figure 9

[0178] (1) 5G DoS Hulk Attack

[0179] ​The attack uses HTTP protocol between 5GC network elements, initiates high-frequency HTTP GET FLOOD requests by controlling the UE to start a large number of threads, each request is independent and uses various confusion techniques to bypass the server cache measures, so that all requests are processed, the purpose of the attack is to occupy a large number of thread resources and computing resources of 5GC. The specific attack scheme is to start 5GC in virtual machine 2, modify the routing configuration of the user plane UPF network element so that user plane traffic data can attack the 5GC network element (http-server), then generate a simulated UE in virtual machine 1 to initiate a registration process and access the 5G network, a virtual network card will be generated after establishing the PDU session, and a plurality of attacks are initiated by configuring the Hulk traffic tool such as IP proxy, attack target, attack confusion technology, etc. Each attack lasts 80s. The attack features are that the attack source is only one device, the device sends a large number of data packets, and the time interval of the data packets is extremely short, so that the access amount of the 5GC increases by dozens of times or even hundreds of times in an instant, occupies a large amount of computing resources and memory resources of the 5GC, and the normal UE service cannot be normally served, which is a typical network attack behavior.

[0180] Based on the above 5G DoS Hulk Attack case, the present application verifies and collects data on a 5G network experiment platform. First, a simulated UE is connected to the 5GC, and then the 5G DoS Hulk Attack is initiated. The IP proxy is set to the virtual network card generated by the simulated UE, and the attack target is the SMF network element in the 5GC. After the attack starts, the simulated UE will send a large number of independent HTTP requests, as shown in Figure 10 .

[0181] The 5GC needs to process a large number of requests, resulting in the inability to provide registration services for normal UEs, as shown in Figure 11 .

[0182] After stopping the 5G DoS Hulk Attack, the UE registration process can be normally processed, as shown in Figure 12 .

[0183] (2) 5G DoS Slowhttp Attack

[0184] The attack is also called HTTP slow attack, which utilizes the HTTP legal mechanism used by the 5GC network element, that is, by changing the HTTP request format to make it maliciously keep connecting with the 5GC for a long time, continuously consume and occupy a large number of thread resources, memory resources and the like of the 5GC. The specific scheme is: starting 5GC in virtual machine 2, modifying the routing configuration of the user plane UPF network element so that the user plane traffic data can attack the 5GC network element. In virtual machine 1, a simulated UE initiates a registration process to access the 5G network, and a virtual network card is generated after the PDU session is established. By configuring the slowhttptes traffic tool such as proxy IP, maximum number of connections, connection interval time and the like, the connection frequency is set to 10 / S, 50 / S, 100 / S respectively and multiple attacks are initiated, and each attack lasts for 80s. The attack features are that the attack source is only one device, the device sends a large number of TCP requests, and each request keeps connecting for a long time without releasing, resulting in that the 5GC service is unavailable, which is a typical network attack behavior.

[0185] Based on the above 5G DoS Slowhttp Attack case, the present application verifies and collects data on the 5G network experiment platform. First, the simulated UE accesses the 5GC, and then initiates the 5G DoS Slowhttp Attack. The IP proxy is set to the virtual network card generated by the simulated UE, and the attack target is the SMF network element in the 5GC. The connection interval is 10s, the duration is 80s, and the configuration is as shown in Figure 13

[0186] After the attack starts, a large number of independent HTTP requests are sent, and after 30s, the service is shown to be unavailable, as shown in Figure 14

[0187] The SMF network element in the 5GC receives a large number of HTTP requests, causing the number of files opened by the system and the number of communication links to exceed the maximum limit, as shown in Figure 15

[0188] (3) 5G DDoS Bonesi Attack

[0189] ​​​The attack is a DDoS attack simulating a botnet, which generates a large number of TCP, UDP, ICMP requests to the UPF in a short time by controlling the botnet, and sets different parameters such as sending rate and payload size, so that the UPF cannot provide services for legitimate users. The specific scheme is to start the 5GC in the virtual machine 2. In the virtual machine 1, 10 simulated UEs are generated to initiate the registration process to access the 5G network as a botnet, and 10 virtual network cards are generated after the PDU session is established, which respectively initiate a large flow attack to the UPF. By configuring the Bonesi flow tool such as proxy IP, using protocol type, etc., the attack frequency is set to 100 / S, 500 / S, 1000 / S, and multiple attacks are initiated, each attack lasting 80s. The attack features are that the attack sources are multiple devices, each device sends a large number of data packets, and the packet sending time interval is extremely short. The 5GC receives a large number of data packets from different devices, which occupies a large number of resources on the server, and is a typical network attack behavior.

[0190] Based on the above 5G DDoS Bonesi Attack case, the present application verifies and collects data on the 5G network experiment platform. First, 10 simulated UEs are generated to initiate the registration process and access the 5GC, and then the 5G DDoS Bonesi Attack is initiated. The IP proxy is set, and the attack target is the UPF network element in the 5GC. After the attack starts, each simulated UE will send a large number of TCP requests, as shown in Figure 16 .

[0191] At this time, an additional simulated UE is generated to initiate the registration process, and then a packet filling software is used to send data packets to the UPF to simulate the traffic of normal UEs. By comparing the packet filling data before and after the 5G DDoS Bonesi Attack Figure 17 and Figure 18 , it is found that the packet loss rate increases from 0.45% to 79%,

[0192] 5G network abnormal flow collection:

[0193] During abnormal flow collection, all flows are set to be captured at the UPF network element interface. The reason is that the UPF implements the functions of routing and forwarding of user plane data packets, and the user traffic of all UEs in the range area needs to flow through this interface to avoid the need to collect and process traffic when facing collaborative attacks and improve detection efficiency. And the UPF interfaces are connected to multiple important network element nodes, such as connecting to 5G base stations using N3 interface, connecting to 5GC using N4 interface, and connecting to DN using N6 interface. Therefore, flow collection at this interface can capture malicious traffic targeting different network element nodes.

[0194] The 1426457 marked flows are collected at the interface of the UPF network element, and 4 types of data are included, including normal traffic, 5G DoS Hulk Attack, 5G DoS Slowhttp Attack and 5G DDoSBonesi Attack traffic, each type of data is divided into a data subset using a sliding window, the window size is set to 50, that is, each data subset contains all data streams within 50 seconds, 28 features of the data set at each moment are counted in chronological order, as shown in Table 3, and finally the feature set of all processed data is obtained.

[0195] Table 3: Data set features

[0196]

[0197]

[0198] Anomaly detection result analysis

[0199] The application first analyzes the feature selection based on the GYAC algorithm, including important features that can be selected, changes of feature dimensions with threshold values and the like. Then, the GYAC-LSTM model is used to detect and classify 5G network traffic, and the relationship between detection performance and training cost under different feature dimensions is studied. Finally, the Tad-GAN and DAGMM models are compared and analyzed with the detection model proposed in the application.

[0200] The performance indicators used in the application include accuracy (Accuracy, Acc), precision, recall, harmonic mean (F1 score), performance-cost (Performance-Cost, PC) comprehensive benefit representation, PC comprehensive benefit refers to the ratio of Acc and training time (Train-Time), the larger the value, the higher the comprehensive benefit of Acc and Train-Time cost, otherwise the lower the comprehensive benefit, the formula of Accuracy and PC comprehensive benefit is shown in formula (18) and formula (19).

[0201]

[0202]

[0203] The application uses a feature selection algorithm based on GYAC, in a total data set including normal, 5G DoS Hulk Attack, 5G DoS Slowhttp Attack and 5G DDoSBonesi Attack, the importance coefficient of each feature is evaluated and sorted according to the contribution of data classification, such as Figures 19 to 22As shown, it is shown that under the algorithm proposed by us, the top 10 features and importance scores in each data type are selected.

[0204] Figure 23 The curves between the feature dimension reduction rate and the importance threshold m2 are given under different redundancy thresholds m1, m1 is respectively 0.25, 0.5, 0.75 and 1.0. Overall, in the proposed feature selection algorithm, the feature reduction rate can be as high as about 0.85. With the increase of the importance threshold m2, the feature dimension reduction rate decreases, the dimension reduction ability decreases, and the feature dimension reduction rate eventually decreases to 0, that is, no dimension reduction is performed on the data. This is due to the fact that after the feature selection of the redundancy threshold m1, m2 is large, so that all features are retained and no feature dimension reduction is performed.

[0205] At the same importance threshold m2, with the increase of the redundancy threshold m1, the feature dimension reduction increases, and the dimension reduction ability improves. This is because the larger the value of m1, the better the dimension reduction ability, which is caused by the increase of the sample space of redundant features. At this time, under the same importance threshold m2, the more important features can be selected, that is, the probability of selecting the most important features is larger, so that more same features can be removed when the union set is calculated.

[0206] In addition, it can be observed from the figure that the decay rate of the feature dimension reduction rate will decrease with the increase of m1, and the reason is similar to the above content. Because the sample space of redundant features is small, it is more difficult to select features with higher importance, and the same rate of important features is low when the union set is calculated, resulting in poor dimension reduction ability.

[0207] To verify whether the target feature subset after dimension reduction can effectively detect and classify normal and various abnormal flows, the application limits different m1 and m2 thresholds, and sets the target feature dimension to 0.25, 0.50, 0.75 of the total feature set, respectively, to obtain multiple target feature subsets under the corresponding feature dimension ratio, as shown in Table 4, which represents the value of m2 under each feature dimension ratio when m1 takes values of 0.25, 0.50, 0.75 and 1.00, wherein the null value represents that the target feature dimension cannot be reduced to the set target feature dimension under the current condition.

[0208] Table 4 LSTM model parameter setting

[0209]

[0210] The above data set with different feature dimension ratios and the full feature set is used for training and testing of the LSTM classification model, and the parameters of the LSTM network are as shown in Table 5.

[0211] Table 5 LSTM model parameter setting

[0212]

[0213] like Figure 24 The graph shows the changes in detection performance and training time under different feature dimensions. The horizontal axis represents the proportion of the feature dimensions used in the training and testing datasets to the total feature dimensions, and the vertical axis represents the detection performance and training time for the corresponding feature dimensions. It can be seen that the overall trend is that as the feature dimension increases, the Acc and F1 scores of the model classification become larger. When the feature dimension proportion is only 0.25, the accuracy and F1 score remain around 90%. When the feature dimension proportion reaches 0.75, both Acc and F1 scores exceed 98%, approaching the detection performance of the full feature set, and can basically correctly classify normal and different abnormal traffic. At the same time, the training time of the detection model also increases with the increase of the feature dimension, but compared to when feature selection is not used, its training time can be reduced by up to about 15%.

[0214] To verify the relationship between detection performance and model training time cost, we analyzed the performance-cost-effectiveness of anomaly detection using different feature dimensions, such as... Figure 25 As shown, the graph represents the performance ratio and performance-cost-benefit variation curves under different feature dimensions. In order to unify the scale of the model's detection performance and training time, this invention converts the Acc and training time under different feature dimensions into the proportion of the Acc and training time under the current feature dimension to the sum of all Acc and the sum of all training times, and normalizes the PC comprehensive benefit index. Therefore, in the graph, the horizontal axis represents the proportion of the feature dimensions of the dataset used for training and testing to the total feature dimensions, and the vertical axis represents the proportion of Acc and training time under the current feature dimension, as well as the performance-cost-benefit ratio.

[0215] As the feature dimension ratio increases, the model's Performance-Proportion and Time-Proportion curves gradually rise, indicating better detection performance but longer detection time. The Performance-Cost curve represents the combined PC (Acceleration Cost) and training time benefits under different feature dimensions. It can be seen that the benefits are greatest when the feature degree ratio is 0.25 and 0.5, and decrease by about 20% at 0.75, but all are far greater than the combined benefits without using the proposed feature selection algorithm, verifying the advantages of the detection model proposed in this invention.

[0216] This invention also compares its model with two classic anomaly detection models, Tad-GAN and DAGMM. Tad-GAN is a generative model containing two GAN networks, capable of decomposing time series into smooth base signals and noise signals, and is often used as a benchmark for time series anomaly detection. DAGMM is an anomaly detection model that combines deep autoencoders and Gaussian mixtures, and has good applicability in handling high-dimensional and complex distributed data.

[0217] like Figure 25 As shown, the graph represents the changes in detection performance and PC overall benefit of different models. The horizontal axis represents different detection models, including our proposed GYAC-LSTM(0.50) model with a dimension ratio of 0.50, the LSTM model without feature selection, and the Tad-GAN and DAGMM models. The vertical axis represents the detection performance and training time cost of each model. For ease of comparison, the PC overall benefit index is normalized in this invention.

[0218] From the perspective of the Acc metric, our proposed GYAC-LSTM (0.50) is slightly lower than other models, at around 95%. This is because some important features are removed after feature selection, leading to a decrease in the overall Acc. From the perspective of the F1 metric, the F1 scores of our proposed GYAC-LSTM and LSTM models fluctuate less with the Acc. This is because the training process uses all normal and abnormal traffic, so the model's Precision and Recall are relatively close. In contrast, the F1 scores of the Tad-GAN and DAGMM models are lower, indicating a lower detection rate of abnormal traffic or a higher false detection rate of normal traffic. This is mainly because the model classifies traffic exceeding the normal threshold as abnormal, and its hard threshold problem leads to an imbalance in the Precision and Recall metrics. However, the advantage is that the model training process only needs to use normal traffic data, reducing the dependence on traffic type labels.

[0219] From the perspective of PC metrics, GYAC-LSTM(0.50) has a higher overall PC gain because we used a feature selection algorithm to reduce the feature dimensionality, saving 8% to 44% in training time cost compared to similar algorithms. In contrast, Tad-GAN and DAGMM models are more complex due to the inclusion of multiple network structures, resulting in longer training times and lower PC metrics.

[0220] The application provides a 5G network traffic anomaly detection method based on GYAC-LSTM, first, the original data is preprocessed by conditional filtering, then the characteristic values in the data are obtained by a statistical method and a candidate feature set is generated, then important features are screened and redundant features are removed based on a GYAC feature selection algorithm, the dimension of the experimental features is reduced, and the newly generated target feature subset is used as input for LSTM model training. The experimental results show that the method can greatly reduce the feature dimension and the accuracy of abnormal traffic identification can be maintained at 93% to 98%. Compared with similar algorithms, the training time cost is saved by 8% to 44%.

[0221] The following is a system embodiment corresponding to the above method embodiment. The present embodiment can be implemented in cooperation with the above-mentioned embodiments. The related technical details mentioned in the above-mentioned embodiments are still valid in the present embodiment. In order to reduce repetition, they will not be repeated here. Correspondingly, the related technical details mentioned in the present embodiment can also be applied in the above-mentioned embodiments.

[0222] The application also provides a 5G network traffic anomaly detection system based on GYAC-LSTM, which comprises:

[0223] A data preprocessing module is configured to obtain 5G network traffic data with labeled abnormal information, perform conditional filtering on the 5G network traffic data, and obtain original training data.

[0224] A feature selection module is configured to perform network packet analysis on the original training data, obtain characteristic values in the data, and generate respective candidate feature sets, perform feature selection on the candidate feature sets based on GYAC, remove network traffic data in the candidate feature sets, and obtain target training data.

[0225] A training module is configured to input the target training data into an LSTM model, perform 5G network traffic anomaly detection, construct a loss function based on the detection result and the labeled abnormal information of the target training data, train the LSTM model, and obtain a traffic anomaly detection model.

[0226] An anomaly detection module is configured to input 5G network traffic to be detected into the traffic anomaly detection model, and obtain abnormal information of the 5G network traffic to be detected as a detection result.

[0227] The 5G network traffic anomaly detection system based on GYAC-LSTM, wherein the data preprocessing module comprises:

[0228] For the 5G network traffic data, first, the data is cleaned by using a filtering method to remove irrelevant data, then the cleaned traffic data is sorted in chronological order, the maximum length is set as Z, and the time interval t is set, all data streams within t seconds are divided into a data stream subset flowt Then use statistical methods to calculate flow. t K-dimensional feature set F K,t , where F K,t ={f 1,t ,f 2,t ,...,f K,t Arrange the feature vectors of all time intervals t to obtain a dataset D of one type of traffic. K,T D K,T ={F K,1 ,F K,2 ,...,F K,T};

[0229] The aforementioned 5G network traffic anomaly detection system based on GYAC-LSTM includes a feature selection module comprising: using the Gini index difference and the year-on-year decrease index to jointly represent the contribution to the classification of two types of traffic data; sequentially calculating the contribution of features of different types of data, summing and ranking them to obtain the importance ranking of traffic features; using cosine similarity to represent the correlation between different features in the same type of traffic data, converting it into the distance between features; then selecting features with high correlation coefficients and importance coefficients based on redundancy thresholds and importance thresholds; finally, finding the union of the selected features for each type of traffic to obtain the target training data.

[0230] The aforementioned 5G network traffic anomaly detection system based on GYAC-LSTM, wherein the feature selection module includes:

[0231] For a three-dimensional dataset D N×K×T Where N represents the number of data types, K represents the dimension of the features, and T represents the length of the data. If a certain type of traffic data is represented, then The feature set is represented as in The Gini index measures the impurity or uncertainty coefficient of a certain feature, as shown in equation (7):

[0232]

[0233] In the formula Representation of features The probability of different values ​​in the eigenvalues ​​is represented by the Gini index, which ranges from 0 to 1. Let n1, n2 ∈ N, and use the Gini difference to represent the eigenvalues. Data The contribution coefficient for classification is shown in equation (8):

[0234]

[0235] characteristic value the mean value under the total length T, as shown in the following formula (9):

[0236]

[0237] characteristics using the same proportion reduction index data the contribution coefficient two of classification, as shown in the following formula (10):

[0238]

[0239] In the formula The contribution coefficient one and the contribution coefficient two are taken with different weights and summed up together as the characteristic the total contribution of distinguishing two types of flow data, as shown in the following formula (11):

[0240]

[0241] The contribution of the flow data to other flow data is calculated and summed up to obtain the characteristic The characteristic importance coefficient of the characteristic , as shown in the following formula (12):

[0242]

[0243] The correlation between characteristics is calculated using the cosine similarity, and the correlation coefficient of k1, k2 ∈ K is and is The distance between the two coefficients is represented as shown in the following formula (14):

[0244]

[0245] All distances between and other characteristics are calculated in turn; according to the importance coefficient and the distance coefficient of the characteristic , important feature selection is performed according to a preset redundancy threshold m1, and the proportion of the number of features farthest from the characteristic is retained according to the preset importance threshold m2, and the proportion of the number of features with the highest importance coefficient ranking after removing the characteristics redundant to the characteristic according to m1 is determined, to obtain The candidate feature subset of The feature subsets of each type of data N×K×T are taken and collected to obtain the target training data of D

[0246] The GYAC-LSTM-based 5G network traffic anomaly detection system, wherein the training module comprises:

[0247] The input layer of the LSTM model normalizes the features of the target training data, as shown in the following formula (15) and formula (16):

[0248]

[0249]

[0250] In the formula , represents the input of the original feature value; , respectively, represent the minimum value and the maximum value in the feature set;V max , V min , respectively, represent the maximum value and the minimum value of the mapping interval; , represents the normalized result after scaling; let the total time step of the data be T, each step contains K-dimensional features, and the input is represented as Input={X 1,K , X 2,K ,..., X T,K}, each training includes T time steps, each time step corresponds to an LSTM unit, and each unit processes K-dimensional feature data, and finally the prediction result is input into the fully connected layer; the output dimension of the fully connected layer is the type number of the traffic data, assuming N, then the output value is Output={Y1,Y2,...,Y N}, in order to correspond the output of the fully connected layer to the probability of predicting a certain category, the softmax function is used to map the output to between 0 and 1, and ensure that all outputs sum to 1, as the probability value of classification under the current input, let y i =[y1,y2,...,y N ], the output probability value of y i after the softmax function is as shown in the following formula (17);

[0251]

[0252] In the formula S i , represents the probability value of the model predicting a certain type, and the class corresponding to the maximum probability is taken as the detection result.

Claims

1. A GYAC-LSTM based 5G network traffic anomaly detection method, characterized in that, The method comprises the following steps: A data preprocessing step, obtaining 5G network traffic data with labeled abnormal information, performing conditional filtering on the 5G network traffic data to obtain original training data; A feature selection step, performing network packet analysis on the original training data to obtain feature values in the data and generate respective candidate feature sets, performing feature selection on each candidate feature set based on GYAC to remove redundant features in the candidate feature set, and obtaining target training data; A training step, inputting the target training data into an LSTM model, performing 5G network traffic anomaly detection, constructing a loss function based on the detection result and the labeled abnormal information of the target training data to train the LSTM model, and obtaining a traffic anomaly detection model; An anomaly detection step, inputting the 5G network traffic to be detected into the traffic anomaly detection model, and obtaining the abnormal information of the 5G network traffic to be detected as the detection result; The feature selection step comprises: The contribution of two types of traffic data classification is represented by the Gini index difference and the same proportion reduction index, the contribution of non-same type data features is calculated in turn and summed and ranked, and the importance ranking of traffic features is obtained; the correlation between different features in the same type of traffic data is represented by the cosine similarity, and is converted into the distance between features, then the features with high correlation coefficient and importance coefficient are selected according to the redundancy threshold and the importance threshold, and finally the selected features of each type of traffic are combined to obtain the target training data.

2. The GYAC-LSTM-based 5G network traffic anomaly detection method of claim 1, wherein, The data preprocessing step comprises: For the 5G network traffic data, first use the filtering method to clean the data, remove irrelevant data, then sort the cleaned traffic data in time sequence, set its maximum length as , and the time interval , divide all data streams within seconds into a data stream subset , and use statistical methods to calculate the dimensional feature set , where , arrange all feature vectors of time interval , and finally get the data set of a class of traffic , where . 3.The GYAC-LSTM based 5G network traffic anomaly detection method of claim 1, wherein, The feature selection step comprises: For a three-dimensional data set where denotes the number of data types, denotes the dimension of the feature, denotes the length of the data, and let denote the flow data of a certain type, then the feature set of is denoted as where ; the impurity or uncertainty coefficient of a certain feature is measured by the Gini index, as shown in equation (7): (7) In the formula representing the characteristics The probability of different values in the middle, the Gini index of the characteristic value is between 0 and 1; set , using the Gini difference value to represent the characteristics Calculate the data The contribution coefficient of classification is shown as formula (8): (8) representative characteristic value under the total length average value under the total length, as shown in the following equation (9): (9) Expressing characteristics using a same-period reduction index Computing data The contribution coefficient of classification, as shown in the following formula (10): (10) In the formula The contribution degree coefficient one and the contribution degree coefficient two are taken different weights and summed up together as the feature The total contribution degree of the two types of flow data is distinguished, as shown in the following formula (11): (11) By calculating the contribution of the flow data to other flow data and summing them up, the feature importance coefficient of the feature is obtained, as shown in the following formula (12): (12) The correlation between features is calculated using cosine similarity, set Then The correlation coefficient of is The distance between two coefficients is represented as follows (14): (14) Calculate in sequence All distances to other features; based on features Important features are selected based on importance coefficients and distance coefficients, according to a preset redundancy threshold. Preservation and features The percentage of features that are furthest apart is determined based on a preset importance threshold. Determine based on Removal and Features After removing redundant features, the proportion of features with the highest importance coefficient is retained to obtain the following result. A subset of candidate features, which includes various types of data. The union of the feature subsets is obtained. The target training data.

4. The GYAC-LSTM-based 5G network traffic anomaly detection method of claim 1, wherein, The training step comprises: The input layer of the LSTM model performs normalization processing on the features of the target training data, as shown in the following formula (16): (16) In the formula This indicates the input of the original feature values; These represent the minimum and maximum values ​​in the feature set, respectively. These represent the maximum and minimum values ​​of the mapped interval, respectively. This represents the normalized result after scaling; let the total time step of the data be... Each step includes 3D features, input representation is Each training session includes There are 10 time steps, each corresponding to one LSTM unit. Each unit will process... The feature data is divided into dimensionalities, and the prediction results are then input into the fully connected layer. The output dimension of the fully connected layer is the number of types of traffic data, assumed to be 1. The output value is To map the output of the fully connected layer to the probability of predicting a certain class, a softmax function is used to map the output to a range of 0 to 1, ensuring that the sum of all outputs is 1, which serves as the probability value for classification under the current input. ,That The output probability value after passing through the softmax function is shown in equation (17) below; (17) In the formula The probability value of a certain type predicted by the model is represented, and the category corresponding to the maximum probability is taken as the detection result. 5.A GYAC-LSTM based 5G network traffic anomaly detection system, characterized in that, The method comprises the following steps: A data preprocessing module, obtaining 5G network traffic data with labeled abnormal information, performing conditional filtering on the 5G network traffic data to obtain original training data; A feature selection module, performing network packet analysis on the original training data to obtain feature values in the data and generate respective candidate feature sets, performing feature selection on each candidate feature set based on GYAC to remove redundant features in the candidate feature set, and obtaining target training data; A training module, inputting the target training data into an LSTM model, performing 5G network traffic anomaly detection, constructing a loss function based on the detection result and the labeled abnormal information of the target training data to train the LSTM model, and obtaining a traffic anomaly detection model; An anomaly detection module, inputting the 5G network traffic to be detected into the traffic anomaly detection model, and obtaining the abnormal information of the 5G network traffic to be detected as the detection result; The feature selection module is configured to: use a Gini index difference value and a same-period reduction index to jointly represent a contribution degree of classification of two types of traffic data, sequentially calculate the contribution degree of non-same type data features, sum and rank the contribution degrees, and obtain an importance ranking of traffic features; use a cosine similarity to represent a correlation between different features in the same type of traffic data, and convert the correlation into a distance between the features, then select features with a high correlation coefficient and a high importance coefficient according to a redundancy threshold and an importance threshold, and finally obtain a union of the selected features of each type of traffic to obtain the target training data.

6. The GYAC-LSTM based 5G network traffic anomaly detection system of claim 5, wherein, The data preprocessing module is configured to: For the 5G network traffic data, first use the filtering method to clean the data, remove irrelevant data, then sort the cleaned traffic data in chronological order, set its maximum length as , and the time interval , divide all data streams within seconds into a data stream subset , and use statistical methods to calculate the dimensional feature set , where , arrange all feature vectors of time interval , and finally obtain a data set of a class of traffic , where .

7. The GYAC-LSTM based 5G network traffic anomaly detection system of claim 5, wherein, The feature selection module is configured to: For a three-dimensional data set where denotes the number of data types, denotes the dimension of the feature, denotes the length of the data, set denotes the flow data of a certain type, then the feature set of is expressed as where ; the impurity or uncertainty coefficient of a certain feature is measured by the Gini index, as shown in equation (7): (7) In the formula representing the characteristic The probability of different values in the middle, the Gini index of the characteristic value is between 0 and 1; set , using the Gini difference to represent the characteristic Calculate the data The contribution coefficient of classification is shown as formula (8): (8) representative characteristic value under the total length average value under the total length, as shown in the following equation (9): (9) Expressing characteristics using a same-period reduction index Computing data The contribution coefficient of classification, as shown in the following formula (10): (10) In the formula The contribution degree coefficient one and the contribution degree coefficient two are taken different weights and summed up together as the feature The total contribution degree of the two types of flow data is distinguished, as shown in the following formula (11): (11) The contribution of the flow data to other flow data is calculated and summed up to obtain the feature importance coefficient of the feature, as shown in the following formula (12): ​ (12) The correlation between features is calculated using cosine similarity, set Then The correlation coefficient of is The distance between two coefficients is represented as follows in Equation (14): (14) successively calculate all distances to other features; according to the importance coefficient and the distance coefficient of the feature , important feature selection is performed, according to a preset redundancy threshold , the proportion of the number of features farthest from the feature , according to a preset importance threshold , the proportion of the number of features farthest from the feature , the proportion of the number of features farthest from the feature , the proportion of the number of features farthest from the feature , the proportion of the number of features farthest from the feature , the proportion of the number of features farthest from the feature , the target training data of the feature subset is obtained.

8. The GYAC-LSTM based 5G network traffic anomaly detection system of claim 5, wherein, The training module is configured to: An input layer of the LSTM model performs normalization processing on features of the target training data, as shown in the following formula (16): (16) In the formula This indicates the input of the original feature values; These represent the minimum and maximum values ​​in the feature set, respectively. These represent the maximum and minimum values ​​of the mapped interval, respectively. This represents the normalized result after scaling; let the total time step of the data be... Each step includes 3D features, input representation is Each training session includes There are 10 time steps, each corresponding to one LSTM unit. Each unit will process... The feature data is divided into dimensionalities, and the prediction results are then input into the fully connected layer. The output dimension of the fully connected layer is the number of types of traffic data, assumed to be 1. The output value is To map the output of the fully connected layer to the probability of predicting a certain class, a softmax function is used to map the output to a range of 0 to 1, ensuring that the sum of all outputs is 1, which serves as the probability value for classification under the current input. ,That The output probability value after passing through the softmax function is shown in equation (17) below; (17) In the formula The probability value of a certain type predicted by the model is represented, and the category corresponding to the maximum probability is taken as the detection result.

Images