Method, device, electronic equipment and medium for detecting network abnormal traffic

Abstract

The application discloses a network abnormal traffic detection method and device, electronic equipment and medium. Through the application of the technical solution, after obtaining the initial traffic characteristics, the detection of whether there is an abnormal traffic characteristic is not directly performed. Instead, the statistical disentanglement module and the characteristic disentanglement module are used to remove the redundancy correlation of each characteristic. So that the subsequent detection of abnormal traffic characteristics is performed on the traffic characteristics with redundancy correlation removed. Thus, the purpose of reducing the noise interference caused by redundancy correlation is achieved, and the disadvantage of easily confusing traffic detection results caused by the existence of redundancy correlation is avoided.

Description

Technical Field

[0001] This application relates to data processing technology, and in particular to a method, apparatus, electronic device, and medium for detecting abnormal network traffic. Background Technology

[0002] In related technologies, wireless network traffic often carries a large number of potential threats, such as DDoS and MITM attacks, which seriously affect the normal operation of wireless networks.

[0003] Intrusion Detection Systems (NIDS) can identify potential security threats by monitoring abnormal traffic patterns in wireless network space. Furthermore, NIDS is a security technology that monitors network activity and identifies malicious behavior. In related technologies, NIDS can record traffic patterns that meet specific conditions and determine the presence of abnormal traffic patterns based on the degree of difference between these patterns and standard traffic patterns, thereby identifying potential threats within the network.

[0004] However, NIDS often ignores the spatial correlation between different flow characteristics, which affects its detection performance and accuracy. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and medium for detecting abnormal network traffic. This solves the problem in related technologies where the spatial correlation between traffic characteristics is ignored by NIDS (Network Access Detection System), affecting its detection effect and accuracy.

[0006] According to one aspect of the embodiments of this application, a method for detecting abnormal network traffic is provided, comprising:

[0007] Collect multiple initial traffic characteristics of the network under test;

[0008] Using a statistical deentanglement module and a characterization deentanglement module, each initial traffic feature is deentangled to obtain multiple traffic features to be detected; wherein, each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the deentanglement process is used to remove redundant correlations between the initial traffic features.

[0009] By utilizing the multiple traffic characteristics to be detected, the presence of abnormal traffic events in the network to be detected is determined.

[0010] Optionally, in another embodiment based on the method described above in this application, the step of using a statistical deentanglement module and a characterization deentanglement module to deentangle each initial traffic feature to obtain multiple traffic features to be detected includes:

[0011] Using the statistical deentanglement module, the initial flow features are subjected to a first deentanglement process to obtain multiple flow features to be processed;

[0012] Using the aforementioned characterization and deentanglement module, a second deentanglement process is performed on each traffic feature to be processed, resulting in multiple traffic features to be detected.

[0013] Optionally, in another embodiment based on the method described above in this application, the step of using the statistical deentanglement module to perform a first deentanglement process on each initial traffic feature to obtain multiple traffic features to be processed includes:

[0014] By using the statistical deentanglement module, the distribution spacing between each initial flow feature is increased, resulting in multiple flow features to be processed that can eliminate redundant correlations between each initial flow feature.

[0015] Optionally, in another embodiment based on the method described above in this application, the step of using the characterization deentanglement module to perform a second deentanglement processing on each traffic feature to be processed to obtain multiple traffic features to be detected includes:

[0016] Using a neural network model, target traffic features in the traffic features to be processed are marked with key detection, resulting in traffic features to be detected that contain the key detection marks. The key detection marks are used to increase the weight parameters of the target traffic features.

[0017] By utilizing the aforementioned characterization deentanglement module, the traffic features to be detected, which include the key detection annotations, are kept in a deentangled state throughout the recognition process of the neural network model.

[0018] The target traffic feature is at least one of the plurality of traffic features to be detected.

[0019] Optionally, in another embodiment based on the method described above in this application, the step of detecting whether there are abnormal traffic events in the network to be detected using the plurality of traffic features to be detected includes:

[0020] Utilize multiple traffic features to be detected to generate a traffic graph snapshot;

[0021] Using graph convolutional networks and Perona Malik diffusion, abnormal flow parameters are identified in the flow graph snapshot;

[0022] If the abnormal traffic parameters are detected, it is determined that there is an abnormal traffic event in the network to be detected.

[0023] Optionally, in another embodiment based on the method described above, after determining that an abnormal traffic event exists in the network to be detected, the method further includes:

[0024] A classifier is used to identify the abnormal event type corresponding to the abnormal traffic parameters.

[0025] According to another aspect of the embodiments of this application, a network abnormal traffic detection device is provided, comprising:

[0026] The acquisition module is configured to acquire multiple initial traffic features of the network under test;

[0027] The processing module is configured to use a statistical deentanglement module and a characterization deentanglement module to perform deentanglement processing on each initial traffic feature to obtain multiple traffic features to be detected; wherein, each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the deentanglement processing is used to remove redundant correlations between each initial traffic feature.

[0028] The detection module is configured to use the multiple traffic characteristics to detect whether there are abnormal traffic events in the network to be detected.

[0029] According to another aspect of the embodiments of this application, an electronic device is provided, comprising:

[0030] Memory, used to store executable instructions; and

[0031] A display is used to execute the executable instructions with the memory to perform the operation of any of the above-described methods for detecting abnormal network traffic.

[0032] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided for storing computer-readable instructions, which, when executed, perform the operation of any of the network abnormal traffic detection methods described above.

[0033] In this application, multiple initial traffic features are collected from the network to be detected; the initial traffic features are de-entangled using a statistical de-entanglement module and a characterization de-entanglement module to obtain multiple traffic features to be detected; each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the de-entanglement process is used to remove redundant correlations between the initial traffic features; the multiple traffic features to be detected are used to detect whether there are abnormal traffic events in the network to be detected.

[0034] By applying the technical solution of this application, after obtaining the initial traffic characteristics, it is not necessary to directly detect whether there are abnormal traffic characteristics. Instead, the statistical deentanglement module and the characterization deentanglement module are first used to remove redundant correlations between each characteristic. This allows subsequent detection of abnormal traffic characteristics to be performed on the traffic characteristics after removing redundant correlations. This reduces noise interference caused by redundant correlations, thereby avoiding the drawback of easily confusing traffic detection results due to the existence of redundant correlations.

[0035] The technical solution of this application will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0036] The accompanying drawings, which form part of this specification, illustrate embodiments of this application and, together with the description, serve to explain the principles of this application.

[0037] This application can be more clearly understood with reference to the accompanying drawings and the following detailed description, wherein:

[0038] Figure 1 This is a schematic diagram of a method for detecting abnormal network traffic proposed in this application;

[0039] Figure 2 This is a flowchart illustrating a method for detecting abnormal network traffic proposed in this application.

[0040] Figure 3 This is a schematic diagram of the system architecture for detecting abnormal network traffic proposed in this application;

[0041] Figure 4 This is a schematic diagram of the electronic device proposed in this application;

[0042] Figure 5 This is a schematic diagram of the electronic device proposed in this application. Detailed Implementation

[0043] Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0044] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0045] The following description of at least one exemplary embodiment is merely illustrative and is not intended to limit the scope of this application or its application or use.

[0046] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0047] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0048] Furthermore, the technical solutions of the various embodiments of this application can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by this application.

[0049] It should be noted that all directional indicators (such as up, down, left, right, front, back, etc.) in the embodiments of this application are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicator will also change accordingly.

[0050] The following is combined Figures 1-3 This application describes a method for detecting abnormal network traffic according to exemplary embodiments thereof. It should be noted that the following application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way. Rather, the embodiments of this application can be applied to any applicable scenario.

[0051] This application also proposes a method, apparatus, electronic device, and medium for detecting abnormal network traffic.

[0052] Figure 1 A schematic flowchart illustrating a method for detecting abnormal network traffic according to an embodiment of this application is shown. Figure 1 As shown, the method for a network intrusion detection system includes:

[0053] S101 collects multiple initial traffic features of the network under test.

[0054] S102, using the statistical deentanglement module and the characterization deentanglement module, the initial flow features are deentangled to obtain multiple flow features to be detected; wherein, each flow feature to be detected corresponds one-to-one with each initial flow feature, and the deentanglement process is used to remove the redundant correlation between the initial flow features.

[0055] S103 utilizes multiple characteristics of the traffic to be detected to detect whether there are abnormal traffic events in the network to be detected.

[0056] In related technologies, wireless network traffic poses numerous potential threats, such as DDoS and MITM attacks, which seriously affect the normal operation of wireless networks and undermine their security.

[0057] Business personnel typically use Network Intrusion Detection Systems (NIDS) to monitor abnormal traffic in wireless network space for security defense. Furthermore, NIDS is a security technology that monitors network activity and identifies malicious behavior.

[0058] In one approach, NIDS primarily comes in two types: rule-based NIDS and anomaly-based NIDS. As an example, rule-based NIDS can match network traffic based on predefined patterns or known malicious sequences, and mark traffic characteristics that meet preset conditions as anomalous traffic characteristics.

[0059] As another example, anomaly-based NIDS can build a reference model based on normal network behavior and mark traffic characteristics that do not match the model as anomalous traffic characteristics. Understandably, because anomaly-based NIDS can detect unknown or novel attack types, it is receiving more attention in the current cybersecurity field.

[0060] In one approach, anomaly-based NIDS can be implemented using different techniques, the most common being statistical methods and deep learning methods. Statistical methods use mathematical or probabilistic models to characterize normal network traffic features and determine the presence of anomalies based on the degree of difference between the traffic features and the corresponding normal traffic features in the model.

[0061] For example, anomaly-based NIDS can use Support Vector Machine (SVM) techniques to employ an optimal hyperplane to separate normal and abnormal traffic features, maximizing the margin between the two types of traffic. Furthermore, deep learning methods can utilize multi-layered neural networks to automatically extract and learn hidden high-level features in network traffic, and use these features to determine whether there are anomalies in the network's traffic characteristics.

[0062] However, NIDS systems in related technologies exhibit inconsistent detection performance for different known or unknown anomalous traffic characteristics. This can mainly be attributed to the entangled distribution of traffic characteristics. In other words, because multiple traffic characteristics are correlated, this correlation can interfere with the machine's identification of traffic characteristics, resulting in an inability to independently identify whether individual network traffic patterns are abnormal.

[0063] For example, at a certain moment, although the network traffic characteristics corresponding to the current transmission traffic greatly exceed the bandwidth load value, the NIDS system may still determine that the network transmission traffic at this moment is within the normal range because the transmission traffic in the network has been in a state of continuous increase for a period of time in the preceding period (e.g., the previous 10 minutes). That is, it will not judge it as abnormal traffic. Understandably, the inability of NIDS to independently identify whether individual network traffic has abnormalities can seriously affect the detection accuracy of NIDS, thereby exacerbating security risks on wireless networks.

[0064] To address the aforementioned issues, this application proposes a method for detecting abnormal network traffic. The method involves first obtaining initial traffic characteristics used to determine the presence of alarm events between networks, then decoupling these characteristics from their initial features. Instead of directly detecting abnormal traffic features, a statistical de-entanglement module and a characterization de-entanglement module are used to remove redundant correlations between the features. This allows subsequent detection of abnormal traffic features to be performed on the traffic characteristics after the redundancy correlations have been removed.

[0065] Furthermore, this application incorporates herein... Figure 2 The plan will be explained in detail:

[0066] Step 1: Collect multiple initial traffic features of the network to be tested.

[0067] In one approach, such as Figure 3 The figure shown is a system architecture diagram of the network abnormal traffic detection method proposed in this application.

[0068] In another approach, the initial traffic characteristics in this embodiment may include IP address, port address, timestamp, duration, etc., to provide a basis for subsequent aggregation and detection of traffic characteristics.

[0069] Step 2: Using the statistical deentanglement module, increase the distribution spacing between each initial flow feature to obtain multiple flow features to be processed that can resolve the redundant correlations between each initial flow feature.

[0070] In one approach, the statistical deentanglement module proposed in this application embodiment can be used to deentangle each initial flow feature, thereby achieving the purpose of eliminating the redundant correlation between each initial flow feature.

[0071] Among them, disentanglement, also known as decoupling, includes features extraction, feature separation, and feature reconstruction of data.

[0072] Specifically, the statistical deentanglement module in this application can use deentanglement technology to decompose the original data (i.e., the initial flow characteristics) into multiple factors or features, and then achieve feature separation and reconstruction by encoding and decoding each factor or feature.

[0073] In this context, the unentangled variables typically contain interpretable semantic information and can reflect the separating factors in data changes. In the generative model, this application can perform specific operations based on these distributions, such as changing traffic allocation.

[0074] Furthermore, the statistical deentanglement module in this application can be a module that deentangles flow features without using a neural network. It is used to maximize the distribution spacing between initial flow features under mathematically satisfied conditions, thereby reducing mutual inference between flow features, alleviating feature distribution entanglement, and reducing redundant correlations between different flow features.

[0075] Step 3: Using a neural network model, target traffic features in the traffic features to be processed are marked with key detections to obtain traffic features to be detected containing key detections. The de-entanglement module is used to ensure that the traffic features to be detected containing key detections remain in a de-entangled state during the recognition process of the neural network model.

[0076] The key detection annotation is used to increase the weight parameters of the target traffic feature. Furthermore, the target traffic feature is at least one of multiple traffic features to be detected.

[0077] In one approach, the characterization deentanglement module is the second stage of the double entanglement proposed in this application. It requires inputting the traffic features to be detected obtained in the previous step into the neural network so that the neural network model first performs key detection and labeling on one or more target traffic features in the traffic features to be processed (i.e., increases the weight parameter of the target traffic feature, so as to achieve the purpose of the subsequent network intrusion detection system to focus on identifying the target traffic feature).

[0078] Understandably, the purpose of the characterization and deentanglement module in this application is to highlight a specific traffic feature of the attack in order to alleviate the problem of inconsistent detection performance and improve the detection performance of NIDS for different attacks.

[0079] As an example, this application can use a set of orthogonal constraints to construct the loss term, thereby ensuring that the representation of flow characteristics always maintains the unentangled property during the computation process.

[0080] In one approach, the target traffic feature can be any one or more features from the traffic features to be processed. For example, taking the initial traffic features as IP address, port address, timestamp, and duration as an example, the traffic features to be processed are the IP address, port address, timestamp, and duration, after which redundant correlations between features have been removed. The target traffic feature can be any one or more features from the IP address, port address, timestamp, and duration.

[0081] In another approach, the selection of target traffic characteristics can be determined based on data such as the current network scenario and historical network alarm information.

[0082] Step 4: Generate a traffic map snapshot using multiple traffic features to be detected.

[0083] In one approach, after obtaining multiple traffic features to be detected for determining whether alarm events exist between networks, this application can use graph convolutional network (GCN) technology to aggregate and analyze the traffic features to be detected.

[0084] Specifically, the multiple traffic features to be detected can first be converted into graph structure data (i.e., traffic graph snapshots), and then GCN can be used to extract and fuse the corresponding features on the nodes and edges so that anomaly detection can be performed based on these features in the future.

[0085] Step 5: Using graph convolutional networks and Peronamalik diffusion techniques, identify any abnormal flow parameters present in the flow graph snapshot.

[0086] Step 6: If abnormal traffic parameters are detected, it is determined that there are abnormal traffic events in the network to be detected.

[0087] Step 7: Use a classifier to identify the abnormal event type corresponding to the abnormal traffic parameters.

[0088] In one embodiment of this application, after obtaining a traffic graph snapshot, PM (Peronamalik) diffusion can be used to amplify the impact of specific traffic features in the attack, and a multi-layer network operator M is introduced into the dynamic graph diffusion technique to capture cross-layer anomalies (such as MITM). After capturing the presence of anomalous traffic parameters, the anomalous event type corresponding to the anomalous traffic parameters in the network to be detected is determined based on a classifier.

[0089] In this application, multiple initial traffic features are collected from the network to be detected; the initial traffic features are de-entangled using a statistical de-entanglement module and a characterization de-entanglement module to obtain multiple traffic features to be detected; each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the de-entanglement process is used to remove redundant correlations between the initial traffic features; the multiple traffic features to be detected are used to detect whether there are abnormal traffic events in the network to be detected.

[0090] By applying the technical solution of this application, after obtaining the initial traffic characteristics, it is not necessary to directly detect whether there are abnormal traffic characteristics. Instead, the statistical deentanglement module and the characterization deentanglement module are first used to remove redundant correlations between each characteristic. This allows subsequent detection of abnormal traffic characteristics to be performed on the traffic characteristics after removing redundant correlations. This reduces noise interference caused by redundant correlations, thereby avoiding the drawback of easily confusing traffic detection results due to the existence of redundant correlations.

[0091] Optionally, in another embodiment based on the method described above in this application, the step of using a statistical deentanglement module and a characterization deentanglement module to deentangle each initial traffic feature to obtain multiple traffic features to be detected includes:

[0092] Using the statistical deentanglement module, the initial flow features are subjected to a first deentanglement process to obtain multiple flow features to be processed;

[0093] Using the aforementioned characterization and deentanglement module, a second deentanglement process is performed on each traffic feature to be processed, resulting in multiple traffic features to be detected.

[0094] Optionally, in another embodiment based on the method described above in this application, the step of using the statistical deentanglement module to perform a first deentanglement process on each initial traffic feature to obtain multiple traffic features to be processed includes:

[0095] By using the statistical deentanglement module, the distribution spacing between each initial flow feature is increased, resulting in multiple flow features to be processed that can eliminate redundant correlations between each initial flow feature.

[0096] Optionally, in another embodiment based on the method described above in this application, the step of using the characterization deentanglement module to perform a second deentanglement processing on each traffic feature to be processed to obtain multiple traffic features to be detected includes:

[0097] Using a neural network model, target traffic features in the traffic features to be processed are marked with key detection, resulting in traffic features to be detected that contain the key detection marks. The key detection marks are used to increase the weight parameters of the target traffic features.

[0098] By utilizing the aforementioned characterization deentanglement module, the traffic features to be detected, which include the key detection annotations, are kept in a deentangled state throughout the recognition process of the neural network model.

[0099] The target traffic feature is at least one of the plurality of traffic features to be detected.

[0100] Optionally, in another embodiment based on the method described above in this application, the step of detecting whether there are abnormal traffic events in the network to be detected using the plurality of traffic features to be detected includes:

[0101] Utilize multiple traffic features to be detected to generate a traffic graph snapshot;

[0102] Using graph convolutional networks and Perona Malik diffusion, abnormal flow parameters are identified in the flow graph snapshot;

[0103] If the abnormal traffic parameters are detected, it is determined that there is an abnormal traffic event in the network to be detected.

[0104] Optionally, in another embodiment based on the method described above, after determining that an abnormal traffic event exists in the network to be detected, the method further includes:

[0105] A classifier is used to identify the abnormal event type corresponding to the abnormal traffic parameters.

[0106] Optionally, in another embodiment of this application, such as Figure 4 As shown, this application also provides a device for detecting abnormal network traffic. It includes:

[0107] The acquisition module 201 is configured to acquire multiple initial traffic features of the network under test;

[0108] Processing module 202 is configured to use a statistical deentanglement module and a characterization deentanglement module to perform deentanglement processing on each initial flow feature to obtain multiple flow features to be detected; wherein each flow feature to be detected corresponds one-to-one with each initial flow feature, and the deentanglement processing is used to remove redundant correlations between each initial flow feature.

[0109] The detection module 203 is configured to use the multiple traffic characteristics to detect whether there are abnormal traffic events in the network to be detected.

[0110] By applying the technical solution of this application, after obtaining the initial traffic characteristics, it is not necessary to directly detect whether there are abnormal traffic characteristics. Instead, the statistical deentanglement module and the characterization deentanglement module are first used to remove redundant correlations between each characteristic. This allows subsequent detection of abnormal traffic characteristics to be performed on the traffic characteristics after removing redundant correlations. This reduces noise interference caused by redundant correlations, thereby avoiding the drawback of easily confusing traffic detection results due to the existence of redundant correlations.

[0111] In another embodiment of this application, the processing module 202 is configured to:

[0112] Using the statistical deentanglement module, the initial flow features are subjected to a first deentanglement process to obtain multiple flow features to be processed;

[0113] Using the aforementioned characterization and deentanglement module, a second deentanglement process is performed on each traffic feature to be processed, resulting in multiple traffic features to be detected.

[0114] In another embodiment of this application, the processing module 202 is configured to:

[0115] By using the statistical deentanglement module, the distribution spacing between each initial flow feature is increased, resulting in multiple flow features to be processed that can eliminate redundant correlations between each initial flow feature.

[0116] In another embodiment of this application, the processing module 202 is configured to:

[0117] Using a neural network model, target traffic features in the traffic features to be processed are marked with key detection, resulting in traffic features to be detected that contain the key detection marks. The key detection marks are used to increase the weight parameters of the target traffic features.

[0118] By utilizing the aforementioned characterization deentanglement module, the traffic features to be detected, which include the key detection annotations, are kept in a deentangled state throughout the recognition process of the neural network model.

[0119] The target traffic feature is at least one of the plurality of traffic features to be detected.

[0120] In another embodiment of this application, the processing module 202 is configured to:

[0121] Utilize multiple traffic features to be detected to generate a traffic graph snapshot;

[0122] Using graph convolutional networks and Perona Malik diffusion, abnormal flow parameters are identified in the flow graph snapshot;

[0123] If the abnormal traffic parameters are detected, it is determined that there is an abnormal traffic event in the network to be detected.

[0124] In another embodiment of this application, the processing module 202 is configured to:

[0125] A classifier is used to identify the abnormal event type corresponding to the abnormal traffic parameters.

[0126] Figure 5 This is a logical structure block diagram of an electronic device according to an exemplary embodiment. For example, electronic device 300 may be an electronic device.

[0127] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory including instructions, which can be executed by an electronic device processor to complete the above-described method for detecting abnormal network traffic. The method includes: collecting multiple initial traffic features under the network to be detected; performing deentanglement processing on each initial traffic feature using a statistical deentanglement module and a characterization deentanglement module to obtain multiple traffic features to be detected; wherein each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the deentanglement processing is used to remove redundant correlations between the initial traffic features; and using the multiple traffic features to be detected to detect whether there are abnormal traffic events in the network to be detected.

[0128] Optionally, the above instructions can also be executed by the processor of the electronic device to complete other steps involved in the exemplary embodiments described above. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0129] In an exemplary embodiment, an application / computer program product is also provided, including one or more instructions that can be executed by a processor of an electronic device to complete the above-described method for detecting abnormal network traffic. The method includes: collecting multiple initial traffic features under a network to be detected; performing deentanglement processing on each initial traffic feature using a statistical deentanglement module and a characterization deentanglement module to obtain multiple traffic features to be detected; wherein each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the deentanglement processing is used to remove redundant correlations between the initial traffic features; and using the multiple traffic features to be detected to detect whether abnormal traffic events exist in the network to be detected.

[0130] Alternatively, the above instructions may also be executed by the processor of the electronic device to complete other steps involved in the above exemplary embodiments.

[0131] Figure 5This is an example diagram of an electronic device 300. Those skilled in the art will understand that it is illustrative. Figure 5 This is merely an example of electronic device 300 and does not constitute a limitation on electronic device 300. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device 300 may also include input / output devices, network access devices, buses, etc.

[0132] The processor 302 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or processor 302 can be any conventional processor. Processor 302 is the control center of electronic device 300, connecting all parts of electronic device 300 via various interfaces and lines.

[0133] The memory 301 can be used to store computer-readable instructions 303. The processor 302 implements various functions of the electronic device 300 by running or executing the computer-readable instructions or modules stored in the memory 301 and calling the data stored in the memory 301. The memory 301 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device 300, etc. In addition, the memory 301 may include a hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, read-only memory (ROM), random access memory (RAM), or other non-volatile / volatile storage devices.

[0134] If the modules integrated in the electronic device 300 are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by instructing related hardware through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when executed by a processor, the computer-readable instructions can implement the steps of the various method embodiments described above.

[0135] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0136] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting abnormal network traffic, characterized in that, Applications in network intrusion detection systems include: Collect multiple initial traffic characteristics of the network under test; The statistical deentanglement module and the characterization deentanglement module are used to deentangle each initial traffic feature to obtain multiple traffic features to be detected. This includes using the statistical deentanglement module to perform a first deentanglement process on each initial traffic feature to obtain multiple traffic features to be processed, and using the characterization deentanglement module to perform a second deentanglement process on each traffic feature to be processed to obtain multiple traffic features to be detected. Each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the deentanglement process is used to remove redundant correlations between the initial traffic features. By utilizing the multiple traffic characteristics to be detected, it is possible to detect whether there are abnormal traffic events in the network to be detected; The statistical deentanglement module is used to perform a first deentanglement process on each initial traffic feature to obtain multiple traffic features to be processed. This includes using the statistical deentanglement module to increase the distribution spacing between each initial traffic feature, thereby obtaining multiple traffic features to be processed that can eliminate redundant correlations between the initial traffic features. The decoupling process of the statistical deentanglement module includes feature extraction, feature separation, and feature reconstruction of the data. Specifically, it is used to decompose the initial traffic features into multiple factors or features, and then achieve feature separation and reconstruction by encoding and decoding each factor or feature. The process utilizes the representation deentanglement module to perform a second deentanglement processing on each traffic feature to be processed, resulting in multiple traffic features to be detected. This includes using a neural network model to perform key detection annotation on the target traffic feature among the traffic features to be processed, resulting in traffic features to be detected containing the key detection annotation, whereby the key detection annotation is used to increase the weight parameters of the target traffic feature. The representation deentanglement module ensures that the traffic features to be detected containing the key detection annotation remain in a deentangled state throughout the recognition process of the neural network model. The target traffic feature is at least one of the multiple traffic features to be detected.

2. The method as described in claim 1, characterized in that, The step of using the multiple traffic features to detect whether there are abnormal traffic events in the network to be detected includes: Utilize multiple traffic features to be detected to generate a traffic graph snapshot; Using graph convolutional networks and Perona Malik diffusion, abnormal flow parameters are identified in the flow graph snapshot; If the abnormal traffic parameters are detected, it is determined that there is an abnormal traffic event in the network to be detected.

3. The method as described in claim 2, characterized in that, After determining that abnormal traffic events exist in the network to be detected, the method further includes: A classifier is used to identify the abnormal event type corresponding to the abnormal traffic parameters.

4. A device for detecting abnormal network traffic, characterized in that, Applications in network intrusion detection systems include: The acquisition module is configured to acquire multiple initial traffic features of the network under test; The processing module is configured to perform deentanglement processing on each initial traffic feature using a statistical deentanglement module and a characterization deentanglement module to obtain multiple traffic features to be detected. This includes performing a first deentanglement processing on each initial traffic feature using the statistical deentanglement module to obtain multiple traffic features to be processed, and performing a second deentanglement processing on each traffic feature to be processed using the characterization deentanglement module to obtain multiple traffic features to be detected. Each traffic feature to be detected corresponds one-to-one with each initial traffic feature, and the deentanglement processing is used to remove redundant correlations between the initial traffic features. The detection module is configured to use the multiple traffic characteristics to detect whether there are abnormal traffic events in the network to be detected; The processing module is also specifically used to perform: By utilizing the statistical deentanglement module, the distribution spacing between each initial traffic feature is increased, resulting in multiple traffic features to be processed that can eliminate redundant correlations between the initial traffic features. The decoupling processing of the statistical deentanglement module includes feature extraction, feature separation, and feature reconstruction of the data. Specifically, it is used to decompose the initial traffic features into multiple factors or features, and then achieve feature separation and reconstruction by encoding and decoding each factor or feature. Using a neural network model, target traffic features in the traffic features to be processed are marked with key detection, resulting in traffic features to be detected that include the key detection marks. The key detection marks are used to increase the weight parameters of the target traffic features. Using the representation deentanglement module, the traffic features to be detected that include the key detection marks are kept in a deentangled state throughout the recognition process of the neural network model. The target traffic feature is at least one of the multiple traffic features to be detected.

5. An electronic device, characterized in that, include: Memory, used to store executable instructions; as well as, A processor, configured to execute the executable instructions with the memory to perform the operation of the network abnormal traffic detection method according to any one of claims 1-3.

6. A computer-readable storage medium for storing computer-readable instructions, characterized in that, When the instruction is executed, it performs the operation of the network abnormal traffic detection method according to any one of claims 1-3.

Images