A method for dynamically constructing a network traffic detection model

Abstract

The application discloses a method for dynamically constructing a network flow detection model, relates to the technical field of network security and modeling, and comprises the following steps: S100, constructing a feature vector; S200, data sampling; and S300, constructing a network flow detection model. The application guarantees the global precision of the network flow detection model, accelerates convergence, reduces the complexity of the model, and improves the modeling efficiency.

Description

Technical Field

[0001] This invention relates to the field of network security and modeling technology, and in particular to a method for dynamically constructing a network traffic detection model. Background Technology

[0002] With the continuous advancement of social informatization and intelligentization, the Internet has extended to all aspects of life, and the era of "Internet Plus" has arrived.

[0003] Traditional network defenses, such as Intrusion Detection Systems (IDS), provide passive defense by focusing on monitoring intrusion behavior. Their design aims to identify violations of security policies or attack patterns by monitoring network or system resources. However, IDS cannot accurately predict the diverse forms of network attack packets, thus creating significant security vulnerabilities. To address this issue, this invention provides a method based on a finite set of training samples, dynamic modeling, and periodic learning of network traffic, which greatly improves the identification of malicious network packets and enhances network defense capabilities.

[0004] Therefore, those skilled in the art are dedicated to developing a method for dynamically constructing network traffic detection models. Summary of the Invention

[0005] In view of the above-mentioned deficiencies of the prior art, the technical problem to be solved by the present invention is how to improve the feature identification of malicious network packets and enhance network defense capabilities.

[0006] The inventors analyzed that static modeling requires a large amount of sample data, is computationally complex, and is extremely time-consuming. To address the shortcomings of existing static modeling methods, the inventors provided a method for constructing a network traffic detection model based on a dynamic adaptive sampling strategy. This method takes into account the impact of the number of samples on modeling efficiency. For the spatial distribution of the initial samples, an optimized Latin hypercube design (OLHD) is adopted. The improved Latin hypercube design (LHD) minimizes the maximum distance between samples and maximizes the minimum distance between samples, ensuring the uniformity of the distribution of sampling points in the sample space and improving the global accuracy of the model. Furthermore, a dynamic adaptive sampling strategy is adopted to continuously refine the potential optimal solution of the model to accelerate the model convergence speed. The potential optimal solution criterion is to select the optimal solution in each iteration and add it to the sample set, continuously approximating the expected value of the model.

[0007] In one embodiment of the present invention, a method for dynamically constructing a network traffic detection model is provided, comprising the following steps:

[0008] S100. Construct feature vectors, obtain attributes that characterize network traffic, analyze network traffic characteristics, and construct feature vectors.

[0009] S200, Data Sampling: Based on feature vectors, network traffic is sampled, and the sample space is optimized using an optimized Latin hypercube to output a set of sample points;

[0010] S300. Construct a network traffic detection model and use a set of sample points to perform modeling based on a dynamic adaptive sampling strategy.

[0011] Optionally, in the method for dynamically constructing a network traffic detection model in the above embodiments, step S100 includes:

[0012] S110. Obtain the attributes that characterize network traffic;

[0013] S120. Construct a feature vector, analyze network traffic characteristics, extract feature values ​​of network traffic, and construct a G-dimensional feature vector, where G is a positive integer.

[0014] Optionally, in the method for dynamically constructing a network traffic detection model in any of the above embodiments, the feature values ​​of the network traffic in S120 include, but are not limited to, protocol, port, IP address, MAC address, and network packet.

[0015] Optionally, in the method for dynamically constructing a network traffic detection model in the above embodiments, step S200 includes:

[0016] S210. Construct a sample space: Construct a uniformly distributed sample space based on the feature vectors.

[0017] S220. Optimize the sample space by using optimized Latin hypercube sampling.

[0018] S230. Output sample point set: Based on the optimized sample space, form a sample point set.

[0019] Furthermore, in the method for dynamically constructing a network traffic detection model in the above embodiments, step 210 includes:

[0020] S211. Construct small intervals, and build n based on the number of samples and the dimension of the feature vector. m Intervals, where n is the dimension of the feature vectors and m is the number of samples, divide the n feature vector dimensions into m equally probable intervals, thus dividing the entire sample space into n equally probable intervals. m Small intervals;

[0021] S212. Distribute the samples by placing m samples into a small interval according to the specified requirements.

[0022] Furthermore, in the method for dynamically constructing a network traffic detection model in the above embodiments, the specified requirements include:

[0023] 1. Each sample is randomly distributed with equal probability within a small interval;

[0024] 2. For any sample, when projected onto any one-dimensional space, there is exactly one sample in each subinterval. Normalizing the sample data will cause the range of the design variables to converge to the range of 0 to 1. The sampling points are obtained using the following formula:

[0025]

[0026] Where i represents the i-th sampling point, j represents the j-th dimension, and U represents a random number drawn between [0,1]. Indicates the first i The j-th dimension value of each sampling point, π, is a random permutation of (0, 1, 2, ..., m-1). For any given j, when i iterates from 1 to m, Randomly select values ​​from this range, and for different i, The value will not be repeated, ensuring that when all samples are projected onto the j-th interval, each subinterval has one and only one sampling point.

[0027] Furthermore, in the method for dynamically constructing a network traffic detection model in the above embodiments, optimizing the sample space in step S220 includes optimizing the sample space distribution by combining minimizing the maximum distance between samples and maximizing the minimum distance between samples.

[0028] Optionally, in the method for dynamically constructing a network traffic detection model in any of the above embodiments, step S300 includes:

[0029] S310. Construct the initial model. Construct the initial model for the optimized sample space. The initial model refers to the network traffic detection model that has not been iterated upon for the first time.

[0030] S320. Perform modeling iterations, and iterate the network traffic detection model based on the dynamic adaptive sampling strategy.

[0031] S330. Complete modeling. Use the model accuracy function to check the accuracy of the network traffic detection model. If the accuracy requirements are met, complete the modeling; otherwise, execute S320.

[0032] Furthermore, in the method for dynamically constructing a network traffic detection model in the above embodiments, step 320 includes:

[0033] S321. Update the model by extracting the potential optimal solutions from each iteration and adding them to the sample set. Select multiple samples from the potential optimal solution set that make the network traffic detection model more accurate to update the model. The optimization index of the network traffic detection model is the objective function itself. The sampling sequence is achieved through the following optimization problem:

[0034]

[0035] Where, m i (x), i = 1, 2…ns, represents the constructed surrogate model, δ represents the adaptive sampling adjustment coefficient, x represents the decision variable, S represents the searched optimal solution set, and the mathematical expression of d(x) is as follows, reflecting the deviation between the response value of the surrogate model and the true value:

[0036]

[0037] in, y represents the response value of the proxy model. i Represents the actual value;

[0038] S322, Adaptive sampling adjustment coefficient δ, the value of δ is shown in the following formula:

[0039]

[0040] Where t represents the number of iterations, N represents the iteration termination value, N is a positive integer, θ represents the design expectation value, and the values ​​of coefficients a and k are set according to the convergence requirements. When the number of iterations t approaches N, δ approaches θ.

[0041] S323. Update the model according to the preset number of iterations N. In each iteration, check whether the network traffic detection model has converged through the model accuracy function. If it has converged, the modeling ends. If it has not converged after N iterations, increase the number of iterations N and resample the model.

[0042] The initial model had a sparse sample distribution in the sample space. To improve global accuracy, the inventors relaxed the constraint threshold of the sampling points, that is, increased the adaptive sampling adjustment coefficient δ, to search for new sample points in the unknown space and improve the global accuracy of the network traffic detection model. In the later stages of the network traffic detection model update, the accuracy near the optimal solution region was improved by adjusting the corresponding sampling point constraint threshold, so that more samples converged to the optimal solution region, improving the local accuracy of the network traffic detection model. This reasonable sacrifice of global accuracy to improve local accuracy improved the optimization efficiency of the model.

[0043] Furthermore, in the method for dynamically constructing a network traffic detection model in the above embodiments, step 330 includes:

[0044] S331. Select experimental samples, randomly select K groups of experimental samples (K>=10);

[0045] S332. Test model accuracy: Test the accuracy of the network traffic detection model using a model accuracy verification function, preferably using the mean absolute error (MAE). A ), relative absolute error (R) M ) and goodness of fit (R 2 The mathematical expression is as follows:

[0046]

[0047]

[0048]

[0049] Where N is the number of sampling points, y represents the response value of the proxy model in the i-th sample. i It is the true value of the i-th sample. is the mean of all true values ​​of the samples, and e is the average error between the response value of the surrogate model and the true value;

[0050] S333. When the accuracy of the network traffic detection model meets the accuracy requirements, the modeling ends. Otherwise, increase the iteration number N and continue to execute step S320 to strengthen the model structure and sample layout until the accuracy requirements are met.

[0051] This invention uses optimized Latin hypercube sampling to perform reasonable analysis of sample distribution, minimize the maximum distance between samples and maximize the minimum distance between samples to construct the initial model, ensuring the global accuracy of the network traffic detection model. This invention adopts a dynamic adaptive sampling strategy, which obtains potential optimal solutions as the network traffic detection model iterates, accelerates convergence, reduces model complexity, and improves modeling efficiency.

[0052] The following will further explain the concept, specific structure, and technical effects of the present invention in conjunction with the accompanying drawings, so as to fully understand the purpose, features, and effects of the present invention. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating a method for dynamically constructing a network traffic detection model according to an exemplary embodiment;

[0054] Figure 2 This is a flowchart illustrating the optimized Latin hypercube sampling according to an exemplary embodiment;

[0055] Figure 3 This is a flowchart illustrating a dynamic adaptive sampling strategy according to an exemplary embodiment. Detailed Implementation

[0056] The following description, with reference to the accompanying drawings, illustrates several preferred embodiments of the present invention to make its technical content clearer and easier to understand. The present invention can be embodied in many different forms, and the scope of protection of the present invention is not limited to the embodiments mentioned herein.

[0057] In the accompanying drawings, components with the same structure are indicated by the same numerical designation, and components with similar structures or functions are indicated by similar numerical designations. The dimensions and thicknesses of each component shown in the drawings are arbitrary, and the present invention does not limit the dimensions and thicknesses of each component. To make the illustrations clearer, the thickness of components is schematically exaggerated in some places in the drawings.

[0058] The inventors designed a method for dynamically constructing network traffic detection models, such as... Figure 1 As shown, it includes the following steps:

[0059] S100. Construct feature vectors to obtain attributes representing network traffic, analyze network traffic characteristics, and construct feature vectors; specifically including:

[0060] S110. Obtain the attributes that characterize network traffic;

[0061] S120. Construct a feature vector, analyze network traffic characteristics, extract feature values ​​of network traffic, and construct a G-dimensional feature vector, where G is a positive integer. The feature values ​​of network traffic include, but are not limited to, protocols, ports, IP addresses, MAC addresses, and network packets.

[0062] S200, Data Sampling: Based on feature vectors, network traffic is sampled, and the sample space is optimized using an optimized Latin hypercube to output a set of sample points; such as... Figure 2 As shown, it specifically includes:

[0063] S210. Construct a sample space: Construct a uniformly distributed sample space based on the feature vectors.

[0064] Specifically, it includes:

[0065] S211. Construct small intervals, and build n based on the number of samples and the dimension of the feature vector. m Intervals, where n is the dimension of the feature vectors and m is the number of samples, divide the n feature vector dimensions into m equally probable intervals, thus dividing the entire sample space into n equally probable intervals. m Small intervals;

[0066] S212. Distribute the samples: Place m samples into intervals according to specified requirements, including:

[0067] 1. Each sample is randomly distributed with equal probability within a small interval;

[0068] 2. For any sample, when projected onto any one-dimensional space, there is exactly one sample in each subinterval. Normalizing the sample data will cause the range of the design variables to converge to the range of 0 to 1. The sampling points are obtained using the following formula:

[0069]

[0070] Where i represents the i-th sampling point, j represents the j-th dimension, and U represents a random number drawn between [0,1]. Let represent the j-th dimension value of the i-th sampling point, where π is a random permutation of (0, 1, 2, ..., m-1). For any given j, when i iterates from 1 to m, Randomly select values ​​from this range, and for different i, The value will not be repeated, ensuring that when all samples are projected onto the j-th interval, each subinterval has one and only one sampling point.

[0071] S220. Optimize the sample space by employing optimized Latin hypercube sampling, combining minimizing the maximum distance between samples and maximizing the minimum distance between samples to optimize the sample space.

[0072] This spatial distribution;

[0073] S230. Output sample point set: Based on the optimized sample space, form a sample point set.

[0074] S300. Construct a network traffic detection model, using a sample point set for modeling based on a dynamic adaptive sampling strategy, specifically including:

[0075] S310. Construct the initial model: Build an initial model for the optimized sample space.

[0076] The "model" refers to the initial, un-iterated network traffic detection model.

[0077] S320: Perform modeling iterations and network traffic detection based on a dynamic adaptive sampling strategy.

[0078] Modeling iteration; specifically including:

[0079] S321. Update the model by extracting the potential optimal solutions from each iteration and adding them to the sample set. Select multiple samples from the potential optimal solution set that make the network traffic detection model more accurate to update the model. The optimization index of the network traffic detection model is the objective function itself. The sampling sequence is achieved through the following optimization problem:

[0080]

[0081] Where, m i(x), i = 1, 2…ns, represents the constructed surrogate model, δ represents the adaptive sampling adjustment coefficient, x represents the decision variable, S represents the searched optimal solution set, and the mathematical expression of d(x) is as follows, reflecting the deviation between the response value of the surrogate model and the true value:

[0082]

[0083] in, y represents the response value of the proxy model. i Represents the actual value;

[0084] S322, Adaptive sampling adjustment coefficient δ, the value of δ is shown in the following formula:

[0085]

[0086] Where t represents the number of iterations, N represents the iteration termination value, N is a positive integer, θ represents the design expectation value, and the values ​​of coefficients a and k are set according to the convergence requirements. When the number of iterations t approaches N, δ approaches θ.

[0087] S323. Update the model according to the preset number of iterations N. In each iteration, check whether the network traffic detection model has converged through the model accuracy function. If it has converged, the modeling ends. If it has not converged after N iterations, increase the number of iterations N and resample the model.

[0088] S330. Complete modeling. Use the model accuracy function to check the accuracy of the network traffic detection model. If the accuracy requirements are met, complete modeling; otherwise, execute S320, which includes:

[0089] S331. Select experimental samples, randomly select K groups of experimental samples (K>=10);

[0090] S332. Test model accuracy: Test the accuracy of the network traffic detection model using a model accuracy verification function, preferably using the mean absolute error (MAE). A ), relative absolute error (R) M ) and goodness of fit (R 2 The mathematical expression is as follows:

[0091]

[0092]

[0093]

[0094] Where N is the number of sampling points, The proxy model is represented in the first... i The response value of each sample, y i It is the true value of the i-th sample. is the mean of all true values ​​of the samples, and e is the average error between the response value of the surrogate model and the true value;

[0095] S333. When the accuracy of the network traffic detection model meets the accuracy requirements, the modeling ends. Otherwise, increase the iteration number N and continue to execute step S320 to strengthen the model structure and sample layout until the accuracy requirements are met.

[0096] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for dynamically constructing a network traffic detection model, characterized in that, Includes the following steps: S100. Construct feature vectors, obtain attributes that characterize network traffic, analyze network traffic characteristics, and construct feature vectors. S200. Data sampling: Based on the feature vector, network traffic is sampled, and the sample space is optimized using an optimized Latin hypercube to output a set of sample points; specifically including: S210. Construct a sample space by constructing a uniformly distributed sample space based on the feature vectors. S220. Optimize the sample space by using optimized Latin hypercube sampling, including optimizing the sample space distribution by combining minimizing the maximum distance between samples and maximizing the minimum distance between samples. S230. Output sample point set, which is formed based on the optimized sample space; S300. Construct a network traffic detection model, using the aforementioned sample point set to perform modeling based on a dynamic adaptive sampling strategy, specifically including: S310. Construct the initial model: Construct the initial model for the optimized sample space. S320. Perform modeling iterations, and iterate the network traffic detection model based on the dynamic adaptive sampling strategy. S330. Complete modeling. Use the model accuracy function to check the accuracy of the network traffic detection model. If the accuracy requirements are met, complete modeling; otherwise, execute S320.

2. The method for dynamically constructing a network traffic detection model as described in claim 1, characterized in that, Step S100 includes: S110. Obtain the attributes that characterize network traffic; S120. Construct feature vectors, analyze network traffic characteristics, extract feature values ​​of network traffic, and construct G-dimensional feature vectors.

3. The method for dynamically constructing a network traffic detection model as described in claim 2, characterized in that, The characteristics of the network traffic include protocol, port, IP address, MAC address, and network packet.

4. The method for dynamically constructing a network traffic detection model as described in claim 3, characterized in that, Step 210 includes: S211. Construct small intervals, and build n based on the number of samples and the dimension of the feature vector. m Divide the n feature vector dimensions into m equally probable intervals, and the entire sample space into n equally probable intervals. m Small intervals; S212. Distribute the samples by placing m samples into intervals according to specified requirements. The number of samples and the number of intervals are the same, both being m.

5. The method for dynamically constructing a network traffic detection model as described in claim 4, characterized in that, The specified requirements include: Each sample is randomly and equally distributed within a small interval; For any sample, when projected onto any one-dimensional space, there is exactly one sample in each subinterval. Normalizing the sample data will cause the range of the design variables to converge to the range of 0 to 1. The sampling points are obtained using the following formula: in, Indicates the first One sampling point, Indicates the first dimension, express The random number obtained between, Indicates the first The sampling point of the first sampling point Dimensional value, yes A random permutation, for any given ,when When traversing from 1 to m Randomly select values ​​from this range, and for different , The value will not be repeated, ensuring that all samples are projected onto the first... At that time, each small interval has one and only one sampling point. Represents the number of samples. .

6. The method for dynamically constructing a network traffic detection model as described in claim 5, characterized in that, Step 320 includes: S321. Update the model by extracting the potential optimal solutions from each iteration and adding them to the sample set. Select multiple samples from the potential optimal solution set that make the network traffic detection model more accurate to update the model. The optimization index of the network traffic detection model is the objective function itself. The sampling sequence is achieved through the following optimization problem: ， in, , This represents the constructed proxy model. This represents the adaptive sampling adjustment coefficient. Represents decision variables, This represents the set of optimal solutions found. For the set of real numbers, The mathematical expression for this is as follows, reflecting the deviation between the response value of the proxy model and the true value: in, The proxy model is represented in the first... The response value of each sample. It is the first The true value of each sample; S322, Adaptive Sampling Adjustment Coefficient , The values ​​of are shown in the following formula: ； Where t represents the number of iterations, and N represents the termination value of the iteration, where N is a positive integer. This represents the desired design value. The values ​​of coefficients a and k are set according to the convergence requirements. As the number of iterations t approaches N, tend ; S323. Update the model according to the preset number of iterations N. In each iteration, check whether the network traffic detection model has converged through the model accuracy function. If it has converged, the modeling ends. If it has not converged after N iterations, increase the number of iterations N and resample the model.

7. The method for dynamically constructing a network traffic detection model as described in claim 6, characterized in that, Step 330 includes: S331. Select experimental samples, randomly select K groups of experimental samples (K>=10); S332. Test the model accuracy: Test the accuracy of the network traffic detection model using the model accuracy function, employing the mean absolute error R0. A Relative absolute error R M and goodness of fit R 2 The mathematical expression is as follows: Where G is the number of sampling points, It is the mean of all the true values ​​of the samples. This represents the average error between the response value and the true value of the proxy model. S333. When the accuracy of the network traffic detection model meets the accuracy requirements, the modeling ends; otherwise, the iteration number N is increased and step S320 is continued to strengthen the model structure and sample layout until the accuracy requirements are met.

Images