Traffic detection method, traffic detection device, electronic equipment and storage medium

Abstract

The present disclosure provides a traffic detection method, a traffic detection device, an electronic device and a storage medium, and relates to the technical field of communication. The method comprises the following steps: obtaining to-be-detected traffic data, the to-be-detected traffic data comprising multiple to-be-detected access data, each to-be-detected access data comprising multiple to-be-detected behaviors and a behavior category corresponding to each to-be-detected behavior; obtaining the contribution degree of each behavior category to traffic detection; performing word embedding processing on the to-be-detected traffic data to obtain a word embedding matrix, each row of the word embedding matrix representing each to-be-detected access data and each element representing each to-be-detected behavior; performing position coding according to the behavior category to which each element in the word embedding matrix belongs and the contribution degree thereof to obtain a position coding matrix; superimposing the word embedding matrix and the position coding matrix to obtain a target intermediate matrix; and processing the target intermediate matrix through a trained neural network module to obtain a traffic category corresponding to each to-be-detected access data.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a flow detection method, flow detection device, electronic device, and storage medium. Background Technology

[0002] With the widespread adoption of mobile devices and the rapid development of mobile network technology, network security issues have become increasingly serious, and abnormal traffic detection technology has emerged in this context. Abnormal traffic detection technology can identify and prevent potential network attacks, providing security for mobile communication networks.

[0003] In related technologies, the access data to be detected is input into a neural network model for detection to obtain the traffic category of the access behavior to be detected. However, this method considers only one factor, resulting in low accuracy of traffic identification.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide a traffic detection method, a traffic detection device, an electronic device, and a storage medium. This method enables a neural network module to more intuitively understand the contribution of different behavior categories to traffic detection, thereby improving the accuracy of traffic identification by the neural network module.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0007] This disclosure provides a traffic detection method, which includes: acquiring traffic data to be detected, the traffic data to be detected including multiple access data to be detected, each access data to be detected including multiple behaviors to be detected and a behavior category corresponding to each behavior to be detected; obtaining the contribution of each behavior category to traffic detection; performing word embedding processing on the traffic data to be detected to obtain a word embedding matrix, each row of the word embedding matrix representing each access data to be detected, and each element representing each behavior to be detected; performing position encoding according to the behavior category to which each element in the word embedding matrix belongs and its contribution, to obtain a position encoding matrix; superimposing the word embedding matrix and the position encoding matrix to obtain a target intermediate matrix; and processing the target intermediate matrix through a trained neural network module to obtain the traffic category corresponding to each access data to be detected.

[0008] In an exemplary embodiment, obtaining the contribution of each behavior category to traffic detection includes: acquiring training traffic data, the training traffic data including multiple access data and traffic category labels corresponding to each access data, each access data including multiple access behaviors and a behavior category corresponding to each access behavior; determining a behavior category matrix based on the behavior category of each access behavior, each element of the behavior category matrix representing the behavior category of each access behavior; determining the occurrence frequency of each behavior category in each row of the behavior category matrix; forming a behavior category vector for each behavior category by the occurrence frequency of each behavior category in all rows, forming a label vector by the traffic category labels corresponding to each access, and determining the covariance of each behavior category vector and the label vector; and using the covariance of each behavior category vector and the label vector as the contribution of each behavior category to traffic detection.

[0009] In an exemplary embodiment, the method further includes: determining a training target intermediate matrix based on the training traffic data and the contribution of each behavior category to traffic detection; processing the training target intermediate matrix through a neural network module to be trained to obtain a predicted traffic category corresponding to each access data; and training the neural network module to be trained based on the predicted traffic category and the traffic category label to obtain the trained neural network module.

[0010] In an exemplary embodiment, the neural network module to be trained is a converter model, which includes a multi-head self-attention module, a feedforward neural network, a skip connection module, and an output module. The process of processing the intermediate training matrix using the neural network module to obtain the predicted traffic category corresponding to each access data includes: processing the intermediate training matrix using the multi-head self-attention module to obtain a self-attention weight matrix; processing the self-attention weight matrix using the feedforward neural network to obtain a target sequence; processing the input data of the feedforward neural network and the target sequence using the skip connection module to obtain a target output sequence; and processing the target output sequence using the output module to output the predicted traffic category corresponding to each access data.

[0011] In an exemplary embodiment, word embedding processing is performed on the traffic data to be detected to obtain a word embedding matrix, including: for each access data to be detected in the traffic data to be detected, if the number of behaviors to be detected included in the access data to be detected is greater than a preset number, the access data to be detected is truncated; if the number of behaviors to be detected included in the access data to be detected is less than the preset number, the access data to be detected is padded with zeros.

[0012] In an exemplary embodiment, superimposing the word embedding matrix and the position encoding matrix to obtain a target intermediate matrix includes: performing matrix addition on the word embedding matrix and the position encoding matrix to obtain the target intermediate matrix.

[0013] In an exemplary embodiment, the behavior category includes at least two of the following: service behavior, registration behavior, operation process behavior, system information acquisition behavior, network communication behavior, and file operation behavior; the traffic category includes normal traffic category and various abnormal traffic categories.

[0014] This disclosure provides a traffic detection device, comprising: an acquisition module for acquiring traffic data to be detected, the traffic data to be detected including multiple access data to be detected, each access data to be detected including multiple behaviors to be detected and a behavior category corresponding to each behavior to be detected; an obtaining module for obtaining the contribution of each behavior category to traffic detection; a processing module for performing word embedding processing on the traffic data to be detected to obtain a word embedding matrix, each row of the word embedding matrix representing each access data to be detected, and each element representing each behavior to be detected; the obtaining module is further configured to perform position encoding according to the behavior category to which each element in the word embedding matrix belongs and its contribution, to obtain a position encoding matrix; the obtaining module is further configured to superimpose the word embedding matrix and the position encoding matrix to obtain a target intermediate matrix; the obtaining module is further configured to process the target intermediate matrix through a trained neural network module to obtain the traffic category corresponding to each access data to be detected.

[0015] This disclosure provides an electronic device, including: at least one processor; and a storage terminal device for storing at least one program, which, when executed by the at least one processor, causes the at least one processor to implement any of the above-described traffic detection methods.

[0016] This disclosure provides a computer-readable storage medium storing a computer program thereon, characterized in that the computer program, when executed by a processor, implements any of the above-described traffic detection methods.

[0017] The traffic detection method provided in this embodiment obtains a word embedding matrix based on the traffic data to be detected, and performs position encoding based on the behavior category to which each element in the word embedding matrix belongs and the contribution of the behavior category to traffic detection. After inputting the target intermediate matrix obtained from the word embedding matrix and the position encoding matrix into the neural network module, the neural network module can more intuitively understand the contribution of different behavior categories to traffic detection, thereby improving the accuracy of traffic identification by the neural network module.

[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1 This is a flowchart illustrating a traffic detection method according to an exemplary embodiment.

[0021] Figure 2 This is a schematic diagram illustrating the processing of traffic data, as shown in the example.

[0022] Figure 3 This is a flowchart illustrating another traffic detection method according to an exemplary embodiment.

[0023] Figure 4 This is a schematic diagram illustrating the determination of the target intermediate matrix, as shown in an example.

[0024] Figure 5 This is a flowchart illustrating another traffic detection method according to an exemplary embodiment.

[0025] Figure 6 This is a block diagram of a flow detection device in an exemplary embodiment of the present disclosure.

[0026] Figure 7 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment. Detailed Implementation

[0027] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0028] The features, structures, or characteristics described in this disclosure can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more specific details omitted, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0029] The accompanying drawings are merely illustrative of this disclosure, and the same reference numerals in the drawings denote the same or similar parts, thus omitting repeated descriptions of them. Some block diagrams shown in the drawings do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in at least one hardware module or integrated circuit, or in different network and / or processor devices and / or microcontroller devices.

[0030] The flowchart shown in the accompanying drawings is merely illustrative and does not necessarily include all content and steps, nor does it require execution in the described order. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0031] Furthermore, in the description of this disclosure, the terms “a,” “one,” “the,” “the,” and “at least one” are used to indicate the presence of at least one element or component; the terms “comprising,” “including,” and “having” are used to indicate an open-ended inclusion and to mean that there may be other elements or components in addition to the listed elements or components; the terms “first,” “second,” and “third,” etc., are used only as labels and are not a limitation on the number of objects.

[0032] The exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0033] Figure 1 This is a flowchart illustrating a traffic detection method according to an exemplary embodiment. The traffic detection method provided in this disclosure can be executed by any electronic device, and this disclosure does not limit it.

[0034] like Figure 1 As shown, the traffic detection method provided in this embodiment may include the following steps.

[0035] In step S102, the traffic data to be detected is obtained. The traffic data to be detected includes multiple access data to be detected. Each access data to be detected includes multiple behaviors to be detected and the behavior category corresponding to each behavior to be detected.

[0036] In this embodiment of the disclosure, the traffic data to be detected can be network traffic data in text form. By detecting the traffic data to be detected, the traffic category of the traffic data to be detected can be obtained. The traffic category can include normal traffic categories and various abnormal traffic categories. The abnormal traffic categories can include, but are not limited to, ransomware, DDoS, Trojans, infectious programs, etc.

[0037] In an exemplary embodiment, the behavior category includes at least two of the following: service behavior, registration behavior, operation process behavior, system information acquisition behavior, network communication behavior, and file operation behavior.

[0038] The examples below use the above six categories as examples. In actual application, access behaviors can be classified according to the actual situation.

[0039] In step S104, the contribution of each behavior category to traffic detection is obtained.

[0040] In this embodiment of the disclosure, the contribution of each behavior category to traffic detection can characterize the correlation between each behavior category and traffic category (e.g., abnormal traffic category). Different behavior categories have different sensitivities to abnormal traffic. For example, system information acquisition behavior and registration behavior have a greater correlation with abnormal traffic, so the contribution of system information acquisition behavior and registration behavior is greater.

[0041] In this embodiment of the disclosure, each behavior category corresponds to a contribution level. Taking 6 types of behavior as an example, the 6 behavior categories correspond to 6 contribution levels, and the contribution level can be represented by a numerical value.

[0042] In this embodiment of the disclosure, the contribution of each behavior category to traffic detection can be obtained based on the behavior category and traffic category label to which each behavior data belongs during the model training process; in practical applications, the contribution of each behavior category to traffic detection obtained during the training process can be directly obtained.

[0043] In step S106, word embedding processing is performed on the traffic data to be detected to obtain a word embedding matrix. Each row of the word embedding matrix represents each access data to be detected, and each element represents each behavior to be detected.

[0044] In this embodiment of the disclosure, the traffic data to be detected is first preprocessed so that the deep learning model (e.g., the Transformer model) can better understand the data.

[0045] Specifically, word embedding can be performed on each behavior to be detected in each access data in the traffic data to be detected. Word embedding is a technique that maps words or phrases in text to a continuous vector space, which can capture the semantic and grammatical relationships between words.

[0046] In this embodiment, the Word2Vec word embedding algorithm can be used to process the above data. Word2Vec is a neural network-based word embedding method whose goal is to learn the semantic relationships between words by training the neural network. Specifically, the Skip-gram model in Word2Vec can be selected to implement word embedding.

[0047] In this embodiment, during word embedding, Word2Vec represents each word in the text as a fixed-length vector. These vectors form an embedding matrix, where the number of rows equals the number of words in the vocabulary, and the number of columns equals a pre-defined vector dimension. Each row in the matrix represents a vector representation of a word, and each column represents a feature dimension. These vectors can capture the semantic relationships between words; for example, similar words will have a close distance in the vector space. After a one-to-one correspondence with the embedding matrix, the original text-based network traffic data is converted into a vector representation suitable for deep learning models. In subsequent steps, these vectors can be input into deep learning models such as Transformer for network traffic data analysis and prediction.

[0048] Figure 2 This is a schematic diagram illustrating the processing of traffic data, as shown in the example.

[0049] refer to Figure 2 In the application process, word embedding can be performed on the traffic data to be detected (i.e., the network traffic data in the figure) to obtain a word embedding matrix (also known as a word vector matrix).

[0050] In an exemplary embodiment, word embedding processing is performed on the traffic data to be detected to obtain a word embedding matrix, including: for each access data to be detected in the traffic data to be detected, if the number of behaviors to be detected included in the access data to be detected is greater than a preset number, the access data to be detected is truncated; if the number of behaviors to be detected included in the access data to be detected is less than the preset number, the access data to be detected is padded with zeros.

[0051] The preset number can be set according to the actual situation. The preset number is the same as the number of columns in the word embedding matrix, for example, it can be set to 5000.

[0052] In this embodiment of the disclosure, each row of the word embedding matrix represents all the activity behaviors of a specific traffic, and a single element (word vector) in each row corresponds to a single activity (converted into word vector based on the word embedding matrix); considering the balance between performance and complexity, activities with more than 5000 occurrences are truncated, and if the number of activities of a certain traffic does not reach 5000, it is zero-padded, so the length of each row of the matrix (i.e. the number of columns) is fixed at 5000.

[0053] In step S108, position encoding is performed based on the behavior category and contribution of each element in the word embedding matrix to obtain the position encoding matrix.

[0054] In this embodiment, the Transformer model is a deep learning model based on a self-attention mechanism. In order for it to understand the positional information of words in a sentence and thus capture grammatical structure and semantic relationships, positional encoding can be used. The role of positional encoding is to generate a vector representation for each position in the word embedding matrix so as to preserve the order information of words in subsequent self-attention calculations. The dimension of the positional encoding vector is the same as the dimension of the word embedding vector, which facilitates direct matrix addition operations.

[0055] In this embodiment of the disclosure, when performing position encoding on the word embedding matrix, each element can first be position encoded according to the position encoding algorithm and the position information of each element to obtain the initial position encoding vector of each element; according to the contribution degree corresponding to the behavior category to which each element belongs and the initial position encoding vector of each element (e.g., by performing multiplication, superposition or trigonometric function operation, etc.), the position encoding vector of each element is obtained, thereby obtaining the position encoding matrix.

[0056] The location encoding matrix obtained in this embodiment not only considers the location information of each element, but also the contribution of the behavior category to which each element belongs to traffic detection, which can make the subsequent neural network module more accurate in identifying traffic categories.

[0057] In step S110, the word embedding matrix and the position encoding matrix are superimposed to obtain the target intermediate matrix.

[0058] In an exemplary embodiment, the word embedding matrix and the position encoding matrix are superimposed to obtain the target intermediate matrix, including: performing matrix addition operation on the word embedding matrix and the position encoding matrix to obtain the target intermediate matrix.

[0059] In this embodiment of the disclosure, the word embedding matrix and the position encoding matrix have the same dimension, so they can be directly added together.

[0060] In step S112, the target intermediate matrix is ​​processed by the trained neural network module to obtain the traffic category corresponding to each access data to be detected.

[0061] In this embodiment of the disclosure, reference is made to Figure 2 The neural network module can be a transformer model, which can include a multi-head self-attention module, a feedforward neural network, a skip connection module, and an output module. The target intermediate matrix obtained by superimposing the word embedding matrix and the position encoding matrix can be input into the multi-head self-attention module of the neural network module. The multi-head self-attention module, feedforward neural network, skip connection module, and output module in the neural network module process the data in sequence, and finally output the traffic category corresponding to each access data to be detected (i.e., the network traffic classification result in the figure).

[0062] The traffic detection method provided in this embodiment obtains a word embedding matrix based on the traffic data to be detected, and performs position encoding based on the behavior category to which each element in the word embedding matrix belongs and the contribution of the behavior category to traffic detection. After inputting the target intermediate matrix obtained from the word embedding matrix and the position encoding matrix into the neural network module, the neural network module can more intuitively understand the contribution of different behavior categories to traffic detection, thereby improving the accuracy of traffic identification by the neural network module.

[0063] Figure 3 This is a flowchart illustrating another traffic detection method according to an exemplary embodiment.

[0064] In this embodiment of the disclosure, Figure 3 The embodiment illustrates the specific steps for obtaining the contribution of each behavior category to traffic detection; that is, in Figure 3 In the embodiments, the above Figure 1 Step S104 in the embodiment may further include the following steps.

[0065] In step S302, training traffic data is obtained. The training traffic data includes multiple access data and traffic category labels corresponding to each access data. Each access data includes multiple access behaviors and behavior categories corresponding to each access behavior.

[0066] In this embodiment of the disclosure, the traffic data obtained during the training process is similar in form to the traffic data obtained during the application process. During the training process, it is also necessary to obtain the traffic category label corresponding to each access data. The traffic category label can be a normal category label and multiple abnormal category labels. Each label can be represented by a number. For example, if there is 1 normal category label and 7 abnormal category labels, the numbers 1 to 8 can be used to represent the above category labels respectively.

[0067] In this embodiment of the disclosure, access behaviors can be classified according to the content of the access behavior data to obtain the behavior category corresponding to each access behavior; that is, all traffic information is classified according to content, for example, into 6 categories, namely service behavior, registration behavior, operation process behavior, system information acquisition behavior, network communication behavior and file operation behavior.

[0068] In step S304, a behavior category matrix is ​​determined based on the behavior category of each access behavior, where each element of the behavior category matrix represents the behavior category of each access behavior.

[0069] In this embodiment of the disclosure, a behavior category matrix can be generated according to the behavior category to which each access behavior belongs. Each row of the behavior category matrix corresponds to each access, and each element corresponds to each access behavior.

[0070] Specifically, a word embedding matrix can be generated first, and then each element in the word embedding matrix can be labeled according to the behavior category to which each access behavior belongs, so as to generate a behavior category matrix.

[0071] Figure 4 This is a schematic diagram illustrating the determination of the target intermediate matrix, as shown in an example.

[0072] In this embodiment of the disclosure, reference is made to Figure 4 During model training, word embedding can be performed on each access behavior in each access data in the training traffic data (i.e., network traffic data in the figure) to obtain a word embedding matrix; each row in the word embedding matrix represents all data of a single access, and each cell represents a certain behavior of a certain access; then, according to the behavior category to which the access behavior corresponding to each element in the word embedding matrix belongs, the element is labeled to generate a behavior category matrix. Figure 4 In the illustrated behavior category matrix, each filling method represents a behavior category. Taking the above six behavior categories as an example... Figure 4 The behavior category matrix shown includes 6 filling methods; the elements of the behavior category matrix correspond one-to-one with the elements of the word embedding matrix.

[0073] In step S306, the number of occurrences of each behavior category in each row of the behavior category matrix is ​​determined.

[0074] In this embodiment of the disclosure, after determining the behavior category matrix, the frequency of occurrence of each behavior category in each row of the behavior category matrix can be counted.

[0075] Continue to refer to Figure 4For example, to count the occurrences of each behavior category in the 4th row (the number of rows in the figure is only for illustration; in actual application, the corresponding number of rows can be set according to the number of visits), the occurrences of behavior categories 1 to 6 are 50, 78, 23, 56, 45, and 2, respectively.

[0076] In step S308, the occurrence count of each behavior category in all rows is used to form a behavior category vector for each behavior category, and the traffic category label corresponding to each access is used to form a label vector. The covariance of each behavior category vector and label vector is then determined.

[0077] In this embodiment of the disclosure, the number of times each category appears in all rows can be used to form the behavior category vector for each behavior category (e.g., Figure 4 The first to sixth columns of the matrix in the lower right corner are used to create a tag vector containing the traffic category tags corresponding to each access (e.g., ...). Figure 4 The 7th column of the matrix in the lower right corner contains traffic category labels represented by numbers. Each number corresponds to a traffic category label. For example, 0 can represent normal traffic, and 1 to 5 can represent different categories of abnormal traffic.

[0078] In this embodiment of the disclosure, the behavior category vectors can be combined into a matrix, thereby mapping the 5000-dimensional matrix to 6 dimensions, where each dimension records the number of times a certain behavior category occurs; alternatively, the behavior category vectors and label vectors can be combined into a matrix, where the last dimension records the traffic category label.

[0079] In this embodiment of the disclosure, the covariance matrix can also be calculated based on the matrix composed of the behavior category vector and the label vector. The covariance matrix can be used to obtain the covariance between each behavior category vector and other behavior category vectors, that is, the correlation between different behavior categories themselves; it can also be used to obtain the covariance between each behavior category vector and the label vector, that is, the correlation between behavior category and traffic category; for example, the correlation between system information acquisition behavior and registration behavior and abnormal traffic is closer, so the value of the covariance between system information acquisition behavior and registration behavior and abnormal traffic is larger, thereby reflecting the sensitivity of different behavior categories to abnormal traffic.

[0080] In step S310, the covariance of each behavior category vector and the label vector is used as the contribution of each behavior category to traffic detection.

[0081] In this embodiment of the disclosure, the covariance of each behavior category vector and the label vector can be calculated, and the covariance corresponding to each behavior category vector can be used as the contribution of each behavior category; for example, the covariance of the first behavior category vector and the label vector can be used as the contribution of the first behavior category to traffic detection.

[0082] In this embodiment of the disclosure, reference is made to Figure 4 After obtaining the contribution of each behavior category to traffic detection, position encoding can be performed based on the contribution to obtain a training position encoding matrix. The training word embedding matrix and the training position encoding matrix are superimposed to obtain the training target intermediate matrix, which is then input into the neural network model.

[0083] The traffic detection method provided in this disclosure has two advantages. First, it uses the covariance of each behavior category vector and the label vector as the contribution of each behavior category to traffic detection. This allows the contribution of each behavior category to traffic detection to be considered during subsequent location encoding, enabling the neural network module to learn more intuitively the contribution of different behavior categories to traffic detection, thereby improving the accuracy of the neural network module in identifying traffic data. Second, the classification of behaviors to obtain behavior categories and the calculation of covariance are both understandable and derivable, thereby improving the interpretability of the neural network module.

[0084] Figure 5 This is a flowchart illustrating another traffic detection method according to an exemplary embodiment.

[0085] In this embodiment of the disclosure, Figure 5 The embodiment illustrates the training process of the neural network module; that is, in Figure 3 Based on the implementation examples, Figure 5 The flow detection method shown may also include the following steps.

[0086] In step S502, the intermediate matrix of the training target is determined based on the training traffic data and the contribution of each behavior category to traffic detection.

[0087] In this embodiment of the disclosure, the steps for determining the intermediate matrix of the training target during training are similar to the steps for determining the intermediate matrix of the target during application.

[0088] Specifically, word embedding processing is performed on the training traffic data to obtain a training word embedding matrix. Each row of the training word embedding matrix represents each training access data, and each element represents each training behavior. Position encoding is performed according to the behavior category and contribution of each element in the training word embedding matrix to obtain a training position encoding matrix. The training word embedding matrix and the training position encoding matrix are superimposed to obtain the training target intermediate matrix.

[0089] In step S504, the intermediate matrix of the training target is processed by the neural network module to be trained to obtain the predicted traffic category corresponding to each access data.

[0090] In this embodiment of the disclosure, the intermediate matrix of the training target can be input into the neural network module to be trained to obtain the predicted traffic category corresponding to each access data. The predicted traffic category can be one of normal traffic and various abnormal traffic.

[0091] In an exemplary embodiment, reference is made to Figure 2 The neural network module to be trained is a Transformer model, which may include a multi-head self-attention module, a feedforward neural network, a skip connection module (or a skip and regularization module), and an output module. Specifically, the neural network module to be trained processes the intermediate training matrix to obtain the predicted traffic category corresponding to each access data. This process includes: processing the intermediate training matrix through the multi-head self-attention module to obtain a self-attention weight matrix; processing the self-attention weight matrix through the feedforward neural network to obtain a target sequence; processing the input data and target sequence of the feedforward neural network through the skip connection module to obtain a target output sequence; and processing the target output sequence through the output module to output the predicted traffic category corresponding to each access data.

[0092] Specifically, the self-attention mechanism in the Transformer is responsible for capturing long-distance dependencies in the input sequence. The self-attention mechanism generates a weighted representation by calculating the relationship between each word and other words in the input sequence, which is then used for subsequent network layer processing. In this embodiment, multiple self-attention mechanisms (e.g., eight) can be employed.

[0093] Specifically, the self-attention mechanism is calculated using three weight matrices: Q (Query), K (Key), and V (Value), representing the query, key, and value, respectively. Specifically, the input sequence is first transformed into Q, K, and V vectors through a linear layer; then, the dot product of Q and K is calculated to measure the contribution of each word in the input sequence to the current word; this dot product result is further normalized using a softmax function to obtain the final attention weights.

[0094] Specifically, a feedforward neural network may include two linear layers (fully connected layers) and an activation function, which can capture the non-linear features (RELU) of the input data.

[0095] Specifically, skip connections (also known as residual connections) and layer normalization can be used to optimize network performance.

[0096] Among them, skip connections can directly add the input of the feedforward neural network to its output, thereby achieving "skip" transmission of the original input; this structure helps to alleviate the gradient vanishing problem, enabling the model to perform deep training more effectively.

[0097] Layer normalization (also known as regularization) normalizes the output of each layer, ensuring smoother information transfer between different layers in the network and avoiding gradient explosion or vanishing problems.

[0098] In step S506, the neural network module to be trained is trained according to the predicted traffic category and traffic category label to obtain the trained neural network module.

[0099] In this embodiment of the disclosure, a loss value can be determined based on the predicted traffic category and the traffic category label. The model parameters of the neural network module to be trained can be adjusted based on the loss value until the loss value meets the preset conditions, thereby obtaining a trained neural network module.

[0100] The traffic detection method provided in this disclosure can be applied in the following areas: Intrusion detection and prevention: used to detect potential network attack behaviors, such as distributed denial-of-service (DDoS) attacks, botnets, and malware propagation; Data leakage protection: detecting abnormal behaviors that may lead to data leakage, such as stealing user information or attacking internal systems; Load balancing and optimization: helping network operators detect and resolve traffic congestion problems; Network behavior analysis: conducting in-depth analysis of user behavior to identify malicious and fraudulent behaviors; The traffic detection method provided in this disclosure can effectively identify and prevent potential network attacks, providing security for mobile communication networks.

[0101] It should also be understood that the above is only to help those skilled in the art better understand the embodiments of this disclosure, and is not intended to limit the scope of the embodiments of this disclosure. Those skilled in the art can obviously make various equivalent modifications or changes based on the examples given above. For example, some steps in the above methods may be unnecessary, or new steps may be added, etc. Alternatively, any combination of any two or more of the above embodiments may be used. Such modifications, changes, or combinations also fall within the scope of the embodiments of this disclosure.

[0102] It should also be understood that the above description of the embodiments of this disclosure focuses on highlighting the differences between the various embodiments. Similarities or differences not mentioned can be referred to each other, and for the sake of brevity, they will not be repeated here.

[0103] It should also be understood that the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this disclosure.

[0104] It should also be understood that, in the various embodiments of this disclosure, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions between different embodiments are consistent and can be referenced by each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0105] The foregoing section detailed examples of methods for determining network anomaly detection models provided in this disclosure. It is understood that, in order to implement the aforementioned functions, computer devices include corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this disclosure can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0106] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0107] Figure 6 This is a block diagram of a flow detection device in an exemplary embodiment of the present disclosure.

[0108] like Figure 6 As shown, the flow detection device 600 may include: an acquisition module 602, an acquisition module 604, and a processing module 606.

[0109] The acquisition module 602 is used to acquire traffic data to be detected, which includes multiple access data to be detected. Each access data includes multiple behaviors to be detected and a behavior category corresponding to each behavior. The obtaining module 604 is used to obtain the contribution of each behavior category to traffic detection. The processing module 606 is used to perform word embedding processing on the traffic data to be detected to obtain a word embedding matrix. Each row of the word embedding matrix represents each access data to be detected, and each element represents each behavior to be detected. The obtaining module 604 is also used to perform position encoding based on the behavior category and contribution of each element in the word embedding matrix to obtain a position encoding matrix. The obtaining module 604 is also used to superimpose the word embedding matrix and the position encoding matrix to obtain a target intermediate matrix. The obtaining module 604 is also used to process the target intermediate matrix through a trained neural network module to obtain the traffic category corresponding to each access data to be detected.

[0110] In an exemplary embodiment, the obtaining module 604 is further configured to: acquire training traffic data, the training traffic data including multiple access data and traffic category labels corresponding to each access data, each access data including multiple access behaviors and behavior categories corresponding to each access behavior; determine a behavior category matrix based on the behavior category of each access behavior, each element of the behavior category matrix representing the behavior category of each access behavior; determine the occurrence frequency of each behavior category in each row of the behavior category matrix; form a behavior category vector for each behavior category by the occurrence frequency of each behavior category in all rows, form a label vector by the traffic category labels corresponding to each access, determine the covariance of each behavior category vector and the label vector; and use the covariance of each behavior category vector and the label vector as the contribution of each behavior category to traffic detection.

[0111] In an exemplary embodiment, the obtaining module 604 is further configured to: determine a training target intermediate matrix based on the training traffic data and the contribution of each behavior category to traffic detection; process the training target intermediate matrix through the neural network module to be trained to obtain the predicted traffic category corresponding to each access data; and train the neural network module to be trained based on the predicted traffic category and the traffic category label to obtain the trained neural network module.

[0112] In an exemplary embodiment, the neural network module to be trained is a converter model, which includes a multi-head self-attention module, a feedforward neural network, a skip connection module, and an output module. The obtaining module 604 is further configured to: process the training target intermediate matrix through the multi-head self-attention module to obtain a self-attention weight matrix; process the self-attention weight matrix through the feedforward neural network to obtain a target sequence; process the input data of the feedforward neural network and the target sequence through the skip connection module to obtain a target output sequence; and process the target output sequence through the output module to output the predicted traffic category corresponding to each access data.

[0113] In an exemplary embodiment, the obtaining module 604 is further configured to: for each access data to be detected in the traffic data to be detected, if the number of behaviors to be detected included in the access data to be detected is greater than a preset number, then truncate the access data to be detected; if the number of behaviors to be detected included in the access data to be detected is less than the preset number, then pad the access data to be detected with zeros.

[0114] In an exemplary embodiment, the obtaining module 604 is further configured to: perform matrix addition on the word embedding matrix and the position encoding matrix to obtain the target intermediate matrix.

[0115] In an exemplary embodiment, the behavior category includes at least two of the following: service behavior, registration behavior, operation process behavior, system information acquisition behavior, network communication behavior, and file operation behavior; the traffic category includes normal traffic category and various abnormal traffic categories.

[0116] It should be noted that the block diagrams shown in the above figures are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor terminal devices and / or microcontroller terminal devices.

[0117] Figure 7 This is a schematic diagram illustrating the structure of an electronic device according to an exemplary embodiment. It should be noted that... Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0118] like Figure 7 As shown, the electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage section 708 into a random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0119] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0120] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined above in the system of this disclosure.

[0121] It should be noted that the computer-readable medium disclosed herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, terminal device, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, terminal device, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit programs for use by or in connection with an instruction execution system, terminal device, or apparatus. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0123] The units described in the embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor can be described as including a sending unit, an acquisition unit, a determining unit, and a first processing unit. The names of these units do not necessarily limit the specific unit; for example, a sending unit can also be described as "a unit that sends an image acquisition request to a connected server."

[0124] In another aspect, this disclosure also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable storage medium carries one or more programs that, when executed by the electronic device, cause the electronic device to perform the methods described in the following embodiments. For example, the electronic device may perform... Figure 1 The steps shown.

[0125] According to one aspect of this disclosure, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional implementations of the above embodiments.

[0126] It should be understood that any number of elements in the accompanying drawings is for illustrative purposes only and not for limitation, and any naming is for distinction only and has no limiting meaning.

[0127] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0128] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A flow rate detection method, characterized in that, include: Acquire traffic data to be detected, which includes multiple access data to be detected, each access data to be detected including multiple behaviors to be detected and the behavior category corresponding to each behavior to be detected; Obtain the contribution of each behavior category to traffic detection; the contribution of each behavior category to traffic detection represents the correlation between each behavior category and the traffic category; The traffic data to be detected is subjected to word embedding processing to obtain a word embedding matrix. Each row of the word embedding matrix represents each access data to be detected, and each element represents each behavior to be detected. Position encoding is performed based on the behavior category and contribution of each element in the word embedding matrix to obtain the position encoding matrix; The word embedding matrix and the position encoding matrix are superimposed to obtain the target intermediate matrix; The target intermediate matrix is ​​processed by the trained neural network module to obtain the traffic category corresponding to each access data to be detected.

2. The method according to claim 1, characterized in that, Obtain the contribution of each behavior category to traffic detection, including: Acquire training traffic data, which includes multiple access data and traffic category labels corresponding to each access data. Each access data includes multiple access behaviors and behavior categories corresponding to each access behavior. A behavior category matrix is ​​determined based on the behavior category of each access behavior, where each element of the behavior category matrix represents the behavior category of each access behavior. Determine the frequency of each behavior category in each row of the behavior category matrix; The behavior category vector is formed by counting the occurrences of each behavior category across all rows, and the traffic category label corresponding to each access is formed by forming a label vector. The covariance between each behavior category vector and the label vector is then determined. The covariance of each behavior category vector and label vector is used as the contribution of each behavior category to traffic detection.

3. The method according to claim 2, characterized in that, Also includes: Based on the training traffic data and the contribution of each behavior category to traffic detection, determine the intermediate matrix of the training target; The intermediate matrix of the training target is processed by the neural network module to be trained to obtain the predicted traffic category corresponding to each access data. The neural network module to be trained is trained based on the predicted traffic category and the traffic category label to obtain the trained neural network module.

4. The method according to claim 3, characterized in that, The neural network module to be trained is a converter model, which includes a multi-head self-attention module, a feedforward neural network, a skip connection module, and an output module. Specifically, the intermediate matrix of the training target is processed by the neural network module to be trained to obtain the predicted traffic category corresponding to each access data, including: The training target intermediate matrix is ​​processed by the multi-head self-attention module to obtain the self-attention weight matrix; The self-attention weight matrix is ​​processed by the feedforward neural network to obtain the target sequence; The skip connection module processes the input data of the feedforward neural network and the target sequence to obtain the target output sequence. The output module processes the target output sequence to output the predicted traffic category corresponding to each access data.

5. The method according to claim 1, characterized in that, The traffic data to be detected is subjected to word embedding processing to obtain a word embedding matrix, including: For each access data to be detected in the traffic data to be detected, if the number of behaviors to be detected included in the access data to be detected is greater than a preset number, the access data to be detected is truncated; if the number of behaviors to be detected included in the access data to be detected is less than the preset number, the access data to be detected is padded with zeros.

6. The method according to claim 1, characterized in that, The word embedding matrix and the position encoding matrix are superimposed to obtain the target intermediate matrix, including: The target intermediate matrix is ​​obtained by performing a matrix addition operation on the word embedding matrix and the position encoding matrix.

7. The method according to claim 1, characterized in that, The behavior categories include at least two of the following: service behavior, registration behavior, operation process behavior, system information acquisition behavior, network communication behavior, and file operation behavior; the traffic categories include normal traffic categories and various abnormal traffic categories.

8. A flow detection device, characterized in that, include: The acquisition module is used to acquire traffic data to be detected. The traffic data to be detected includes multiple access data to be detected. Each access data to be detected includes multiple behaviors to be detected and the behavior category corresponding to each behavior to be detected. The acquisition module is used to obtain the contribution of each behavior category to traffic detection; the contribution of each behavior category to traffic detection represents the correlation between each behavior category and the traffic category. The processing module is used to perform word embedding processing on the traffic data to be detected to obtain a word embedding matrix. Each row of the word embedding matrix represents each access data to be detected, and each element represents each behavior to be detected. The obtaining module is also used to perform position encoding based on the behavior category and contribution of each element in the word embedding matrix to obtain a position encoding matrix; The obtaining module is further configured to superimpose the word embedding matrix and the position encoding matrix to obtain the target intermediate matrix; The obtaining module is further used to process the target intermediate matrix through a trained neural network module to obtain the traffic category corresponding to each access data to be detected.

9. An electronic device, characterized in that, include: At least one processor; A storage device for storing at least one program, which, when executed by the at least one processor, causes the at least one processor to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

Images