Training flow detection model, flow detection method, device and electronic equipment

Abstract

Some embodiments of the present application provide a method, apparatus, and electronic device for training a traffic detection model, traffic detection, and the method includes: training an initial image classification model using a source domain dataset to obtain a target image classification model; loading the model parameters of the target image classification model into a generative adversarial network model, and training the generative adversarial network model using a target domain dataset to obtain an image generation model; loading a target domain generator into an initial reinforcement model, and training the initial reinforcement model using the target domain dataset to obtain a target traffic detection model. Some embodiments of the present application can improve the detection accuracy of the training model with a smaller amount of data.

Description

Technical Field

[0001] The present application relates to the field of flow detection technology, and in particular to a training flow detection model, a flow detection method, a device, and an electronic device. Background Art

[0002] With the development of network information, the Internet has become an indispensable part of people's daily life. At the same time, network security issues have emerged.

[0003] Currently, neural networks are commonly used to detect malicious traffic to maintain network security. However, the methods of malicious network attacks are constantly evolving, and traditional neural network models trained on traditional malicious traffic data are unable to detect new types of malicious attacks. Collecting new malicious traffic to train the model in a short period of time requires collecting large amounts of data and a long training cycle, which is both time-consuming and costly.

[0004] Therefore, how to provide a technical solution for an efficient method of training a traffic detection model has become a technical problem that needs to be solved urgently. Summary of the Invention

[0005] The purpose of some embodiments of the present application is to provide a training flow detection model, a flow detection method, an apparatus and an electronic device. Through the technical solutions of the embodiments of the present application, a flow detection model with higher accuracy can be trained with a small amount of data while reducing time costs, thereby improving the accuracy of flow detection.

[0006] In a first aspect, some embodiments of the present application provide a method for training a traffic detection model, comprising: training an initial image classification model using a source domain dataset to obtain a target image classification model; loading the model parameters of the target image classification model into a generative adversarial network model, and training the generative adversarial network model using a target domain dataset to obtain an image generation model, wherein the generative adversarial network model includes: an initial source domain generator, an initial target domain generator, an initial discriminator, and an initial classifier; the image generation model includes: the source domain generator, the target domain generator, a target discriminator, and a target classifier; loading the target domain generator into an initial reinforcement model, and training the initial reinforcement model using the target domain dataset to obtain a target traffic detection model, wherein the initial reinforcement model includes: the target domain generator and different scene classifiers.

[0007] In some embodiments of the present application, after the initial image classification model is trained using the source data set, the target image classification model obtained is used to load into the generative adversarial network model, and then the target domain data set is used to train the generative adversarial network model to obtain an image generation model. Finally, the initial reinforcement model composed of the target domain generator and different scene classifiers is trained to obtain a target traffic detection model. In some embodiments of the present application, the source domain data knowledge can be transferred to the target domain data scenario, which has the effect of improving the detection accuracy of the training model with a smaller target domain data set, and providing model support for the subsequent improvement of traffic detection accuracy.

[0008] In some embodiments, before the source domain dataset is used to train the initial image classification model, the method further includes: segmenting and cleaning the original traffic data to obtain multiple communication packets, wherein the original traffic data includes: source domain traffic data and target domain traffic data; extracting set length traffic data from each communication packet in the multiple communication packets; converting the set length traffic data to obtain two-dimensional traffic grayscale map data; and constructing the source domain dataset and the target domain dataset using the two-dimensional traffic grayscale map data and label data corresponding to the two-dimensional traffic grayscale map data.

[0009] Some embodiments of the present application construct a source domain dataset and a target domain dataset after preprocessing the original traffic data to provide data support for subsequent model training.

[0010] In some embodiments, the use of the source domain dataset to train the initial image classification model to obtain the target image classification model includes: inputting the two-dimensional flow grayscale map data in the source domain dataset into the initial image classification model to obtain first output data; comparing the first output data with the label data corresponding to the two-dimensional flow grayscale map data, optimizing the parameters of the initial image classification model, and obtaining the target image classification model.

[0011] Some embodiments of the present application train and optimize the initial image classification model through the source domain dataset to obtain the target image classification model, providing support for migrating the source domain data knowledge to the target domain data scenario.

[0012] In some embodiments, the method of loading the model parameters of the target image classification model into a generative adversarial network model and training the generative adversarial network model using a target domain dataset to obtain an image generation model includes: loading the model parameters into the initial source domain generator and the initial target domain generator to obtain a source domain generator and a domain generator to be trained; inputting the two-dimensional flow grayscale image data in the target domain dataset into the source domain generator and the domain generator to be trained, respectively, to obtain a source domain output result and a target domain output result; obtaining the target classifier based on the target domain output result; and obtaining the target domain generator and the target discriminator based on the source domain output result and the target domain output result.

[0013] Some embodiments of the present application obtain a target domain generator, a target discriminator, and a target classifier by loading model parameters and training the to-be-trained domain generator, the initial discriminator, and the initial classifier, which can provide effective data support for subsequent model training.

[0014] In some embodiments, obtaining the target classifier based on the target domain output result includes: inputting the target domain output result into the initial classifier to obtain a classification result; and adjusting the parameters of the initial classifier by comparing the classification result with the label data corresponding to the two-dimensional flow grayscale image data to obtain the target classifier.

[0015] In some embodiments of the present application, the initial classifier can be trained and optimized to obtain the target classifier through the target domain output result, with low training cost and high efficiency.

[0016] In some embodiments, obtaining the target domain generator and the target discriminator based on the source domain output result and the target domain output result includes: inputting the source domain output result and the target domain output result into the initial discriminator to obtain a discrimination result; optimizing the parameters of the initial discriminator through the discrimination result to obtain the target discriminator; and optimizing the domain generator to be trained using the discrimination result and the classification result to obtain the target domain generator.

[0017] In some embodiments of the present application, an initial discriminator is trained and optimized through the source domain output results and the target domain output results to obtain a target discriminator, and a target domain generator is obtained by optimizing the training domain generator through the classification results and the discrimination results, with low training cost and high efficiency.

[0018] In some embodiments, the target domain generator is loaded into the initial reinforcement model, and the initial reinforcement model is trained using the target domain dataset to obtain the target traffic detection model, including: splicing the target domain generator with the scene classifier to obtain the initial reinforcement model; inputting the two-dimensional traffic grayscale map data in the target domain dataset into the initial reinforcement model respectively to obtain a scene classification result; comparing the scene classification result with the label data corresponding to the two-dimensional traffic grayscale map data, adjusting the parameters of the scene classifier, and obtaining the target traffic detection model.

[0019] Some embodiments of the present application train and optimize the initial reinforcement model after splicing the target domain generator and the scene classifier through the target domain data set to obtain a target traffic detection model, which can realize the migration of source domain data knowledge to the target domain data scene and improve the detection accuracy of the training model.

[0020] In the second aspect, some embodiments of the present application provide a method for traffic detection, including: obtaining a target traffic detection model trained by the method described in any embodiment of the first aspect; inputting the traffic to be detected into the target traffic detection model, and obtaining a traffic classification result output by the target traffic detection model, wherein the traffic classification result characterizes whether the traffic to be detected is normal traffic or malicious traffic.

[0021] Some embodiments of the present application detect the traffic to be detected by a target traffic detection model to obtain a traffic classification result with high accuracy.

[0022] In a third aspect, some embodiments of the present application provide a first training module, configured to train an initial image classification model using a source domain dataset to obtain a target image classification model; a second training module, configured to load the model parameters of the target image classification model into a generative adversarial network model, and train the generative adversarial network model using a target domain dataset to obtain an image generation model, wherein the generative adversarial network model includes: an initial source domain generator, an initial target domain generator, an initial discriminator, and an initial classifier; the image generation model includes: the source domain generator, the target domain generator, the target discriminator, and the target classifier; a third training module, configured to load the target domain generator into an initial reinforcement model, and train the initial reinforcement model using the target domain dataset to obtain a target traffic detection model, wherein the initial reinforcement model includes: the target domain generator and different scene classifiers.

[0023] In a fourth aspect, some embodiments of the present application provide a method for traffic detection, including: an acquisition module, configured to obtain a target traffic detection model trained by the method described in any embodiment of the first aspect; a detection module, configured to input the traffic to be detected into the target traffic detection model, and obtain a traffic classification result output by the target traffic detection model, wherein the traffic classification result characterizes whether the traffic to be detected is normal traffic or malicious traffic.

[0024] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0025] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor can implement a method as described in any embodiment of the first aspect when executing the program.

[0026] In a seventh aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following is a brief introduction to the drawings required for use in some embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0028] Figure 1 A system diagram of flow detection provided for some embodiments of the present application;

[0029] Figure 2 One of the training model architectures provided for some embodiments of the present application;

[0030] Figure 3 One of the flow charts of the method for training a traffic detection model provided in some embodiments of the present application;

[0031] Figure 4 The second diagram of the training model architecture provided for some embodiments of the present application;

[0032] Figure 5 TDVG / SDVG model structure diagram provided for some embodiments of the present application;

[0033] Figure 6 Flowchart 2 of the method for training a traffic detection model provided in some embodiments of the present application;

[0034] Figure 7 A flow chart of a method for flow detection provided in some embodiments of the present application;

[0035] Figure 8 A block diagram of the apparatus for training a traffic detection model provided in some embodiments of the present application;

[0036] Figure 9 A block diagram of a flow detection device provided in some embodiments of the present application;

[0037] Figure 10 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0038] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0039] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0040] In related technologies, the widespread use of electronic devices has led to the deployment of increasing amounts of information, data, and processing processes within networks, making work and life more convenient and efficient. However, with the continuous development of networks, malicious network attacks have emerged, posing security risks. Traditional rule-based malicious traffic detection, while highly accurate in identifying malicious traffic, lacks effective detection of newly emerging malicious traffic. The emergence of deep learning has enabled malicious traffic detection to be implemented using neural networks, effectively detecting malicious traffic. Therefore, deep learning-based malicious traffic detection has become a mainstream solution. While deep learning boasts superior neural network architecture and data learning capabilities compared to traditional machine learning, achieving superior detection and classification results, achieving such high accuracy requires extensive datasets for learning and training in relevant scenarios. In real-world network environments, malicious network attack methods are constantly evolving. Model training based on outdated malicious traffic data is difficult to achieve the desired high accuracy in new malicious traffic scenarios. Consequently, collecting and labeling large amounts of new attack traffic data in a short period of time to provide model training is both time-consuming and labor-intensive. At the same time, cyber attacks are extremely time-sensitive and require effective detection in a very short time, otherwise information data, property safety and even personal safety will be threatened.

[0041] Currently, to detect malicious traffic, existing technologies use the MMD (Maximum Mean Discrepancy) method to implement transfer learning. However, MMD only serves as a loss calculation function for domain-adaptive transfer learning. It does not consider the fine-grained information between the feature distributions of subclass data in the source and target domains, and therefore cannot guarantee detection accuracy.

[0042] It can be seen from the above-mentioned related technologies that the cost of training traffic detection models in the existing technology is high and the accuracy is difficult to guarantee.

[0043] In view of this, some embodiments of the present application provide a method for traffic detection, which trains an initial image classification model, a generative adversarial network model, and an initial reinforcement model, and the three-layer model depends on each other during the training process to obtain a target traffic detection model. The target traffic detection model can be used to detect the traffic to be detected. Some implementations of the present application consider the fine-grained information between the feature distribution of the source domain and the target domain subclass data through the training of the three-layer model, and realize the migration of the source domain data knowledge to the target domain data scenario. The trained model has the effect of high-precision detection with a smaller target domain data set, which provides effective support for the accurate detection of malicious traffic and maintains network security.

[0044] Specifically, some embodiments of this application propose a malicious traffic detection solution based on domain-adaptive transfer learning using MMD-GANs, combining Maximum Mean Discrepancy (MMD) with Generative Adversarial Networks (GANs). This solution applies the MMD-GANs loss calculation to a designed VIT-GANs model that combines a VIT and GANs network structure. This model transfers knowledge from source domain data to target domain data scenarios, achieving high-precision detection with a relatively small target domain dataset.

[0045] To facilitate understanding of the embodiments of the present application, the model structure and data involved in the present application are exemplarily described below.

[0046] The specific calculation method of MMD is as follows:

[0047]

[0048] Among them, N represents the size of the source domain dataset; M represents the size of the target domain dataset; represents the source domain data, s is the amount of source domain data, and t is the amount of target domain data; represents the target domain data; H represents the Hilbert space.

[0049] The VIT model (vision transformer, an image classification model based on the visual attention mechanism) is based on the transformer model. By cutting the image, it obtains image data with sequence information and realizes the transformer in the field of image detection.

[0050] The basic GAN model structure consists of a generative network and a discriminative network model. The network model generates relevant data through the generative network, and uses the discriminative network to learn to identify the attributes between images and update the discriminative network parameters. The game between the generative and discriminative networks enables GAN model training and learning. This embodiment of the application uses a GAN-based CoGAN (Coupled Generative Adversarial Network) network model.

[0051] The source domain dataset contains a large number of labeled datasets, which can provide the dataset required for model training and learning, but this dataset is not the data detected and trained in the task scenario.

[0052] The target domain dataset is a task scenario dataset, but it only has a small amount of labeled data and cannot meet the requirements for model training and learning to a stable and efficient state dataset.

[0053] The following is combined with Figure 1 The overall composition structure of the flow detection system provided by some embodiments of the present application is exemplified.

[0054] like Figure 1 As shown, some embodiments of the present application provide a system diagram for traffic detection, which includes a terminal 100 and a detection server 200. The detection server 200 can collect or receive traffic to be detected generated by the terminal 100. The detection server 200 then uses a pre-deployed target traffic detection model to detect the traffic to be detected and outputs a corresponding traffic classification result. The traffic classification result can be used to determine whether the traffic to be detected is malicious or normal.

[0055] In some embodiments of the present application, the terminal 100 may be a mobile terminal or a non-portable computer terminal, which is not specifically limited in the embodiments of the present application.

[0056] It can be understood that in some embodiments of the present application, the target traffic detection model is obtained after training the initial image classification model, the generative adversarial network model and the initial reinforcement model, and is pre-deployed in the detection server 200.

[0057] In order to achieve accurate detection of network traffic, the detection server 200 first needs to train the relevant model through the training data set to obtain the target traffic detection model. Figure 2 and attached Figure 3 The implementation process of the training traffic detection model performed by the detection server 200 provided in some embodiments of the present application is exemplified.

[0058] In some embodiments of the present application, before training the traffic detection model, it is necessary to first prepare a training model architecture diagram. Figure 2 , Figure 2A diagram of a training model architecture provided for some embodiments of the present application. This diagram includes: a VIT model 210 and a classification layer 211 in the first phase (also known as the source domain learning phase); a generative adversarial network model (also known as an MMD-GANs model) in the second phase (also known as the domain adaptive transfer learning phase), including: an SDVG model (Source domain ViT generation networks, source domain VIT generator) 220, a TDVG model (Target domain ViT generation networks, target domain VIT generator) 230, a domain discriminator 221, and a classifier 231; and a target TDVG model (target domain VIT generator) 240 and a reinforcement model 250 in the third phase (also known as the reinforcement learning phase). Among them, the combination of the VIT model 210 and the classification layer 211 is used as a specific example of the initial image classification model, SDVG is used as a specific example of the initial source domain generator, TDVG is used as a specific example of the initial target domain generator, the domain discriminator 221 is used as a specific example of the initial discriminator, the classifier 231 is used as a specific example of the initial classifier, the target TDVG model 240 is used as a specific example of the target domain generator, and the enhancement model 250 is used as a specific example of the scene classifier. It can be a classifier in any network scenario, and the embodiments of the present application are not specifically limited here.

[0059] The following is combined with Figure 2 The training model architecture diagram shown exemplifies the specific process of training the traffic detection model provided by some embodiments of the present application.

[0060] Please see the attached Figure 3 , Figure 3 A flow chart of a method for training a traffic detection model is provided for some embodiments of the present application. The method for training a traffic detection model includes:

[0061] S300 (not shown in the figure): obtaining a source domain dataset and a target domain dataset.

[0062] It should be noted that the dataset may have been prepared before training, in which case S300 may not be executed and training may start directly from S310; or S300 may need to be executed during training and then the training phase may begin from S310. Specific adjustments may be made based on actual conditions and are not specifically limited in this embodiment of the present application.

[0063] In some embodiments of the present application, S300 at least includes: segmenting and cleaning the original traffic data to obtain multiple communication packets, wherein the original traffic data includes: source domain traffic data and target domain traffic data; extracting set length traffic data from each communication packet in the multiple communication packets; converting the set length traffic data to obtain two-dimensional traffic grayscale map data; and using the two-dimensional traffic grayscale map data and the label data corresponding to the two-dimensional traffic grayscale map data to construct the source domain dataset and the target domain dataset.

[0064] For example, in some embodiments of the present application, data preprocessing is performed on the raw traffic data in a collected dataset to extract characteristic information from each communication traffic packet. Specifically, each traffic packet in the raw traffic data is first segmented to obtain individual communication packets. The traffic data is then cleaned to remove traffic packets containing empty IP addresses. The first 784 bytes of data from each communication packet (as a specific example of traffic data of a specified length) are then extracted. If the packet contains less than 784 bytes, the remaining byte is padded with zeros to a length of 784 bytes. This results in a 28x28 two-dimensional traffic grayscale image (or two-dimensional traffic grayscale image data), which can serve as input data for model training and testing. The labeled labels (or label data) corresponding to the two-dimensional traffic grayscale image are then used to construct the source and target domain datasets, respectively. Multiple two-dimensional traffic grayscale images are present, and this is not specifically limited in this embodiment.

[0065] In other embodiments of the present application, the source and target domain datasets can be divided into training and test sets. Both the training and test sets contain both normal and malicious traffic, and all data has the correct label classification. All source and target domain datasets contain both test and training set components.

[0066] S310: Train the initial image classification model using the source domain dataset to obtain a target image classification model.

[0067] For example, in some embodiments of the present application, the VIT model 210 and the classification layer 211 are trained using a source domain dataset to obtain a trained VIT model and classification layer 211 (as a specific example of a target image classification model).

[0068] In some embodiments of the present application, S310 may include: inputting the two-dimensional flow grayscale image data in the source domain data set into the initial image classification model to obtain first output data; comparing the first output data with the label data corresponding to the two-dimensional flow grayscale image data, optimizing the parameters of the initial image classification model, and obtaining the target image classification model.

[0069] For example, in some embodiments of the present application, a source domain traffic dataset (i.e., a source domain dataset) is learned and trained by the VIT model 210 during the source domain learning phase. The forward computation output of the VIT model 210 and the classification layer 211 (as a specific example of first output data) is compared with the true labels of the data (as a specific example of label data). The model parameters of the VIT model 210 are continuously updated and iterated until the source domain model is trained to achieve high-precision detection results, and a trained VIT model is output. Specifically, a two-dimensional traffic grayscale image is input into the VIT model 210 to obtain the forward computation output of the classification layer 211. This forward computation output is then compared with the labels corresponding to the two-dimensional traffic grayscale image, and the model parameters of the VIT model 210 are continuously updated and iterated until a model that meets accuracy requirements is obtained. When comparing the forward computation output with the labels corresponding to the two-dimensional traffic grayscale image, a suitable loss function can be selected to calculate the comparison results and inversely optimize the model parameters. The embodiments of the present application do not specifically limit the type of loss function.

[0070] S320: Load the model parameters of the target image classification model into a generative adversarial network model, and train the generative adversarial network model using a target domain dataset to obtain an image generation model.

[0071] For example, in some embodiments of the present application, the second stage of training involves overloading the model parameters of the trained VIT model into the MMD-GANs model. The MMD-GANs model is then trained using the target domain dataset to obtain a trained image generation model.

[0072] In some embodiments of the present application, S320 may include: loading the model parameters into the initial source domain generator and the initial target domain generator to obtain a source domain generator and a domain generator to be trained; inputting the two-dimensional flow grayscale map data in the target domain data set into the source domain generator and the domain generator to be trained respectively to obtain a source domain output result and a target domain output result; obtaining the target classifier according to the target domain output result; obtaining the target domain generator and the target discriminator according to the source domain output result and the target domain output result.

[0073] For example, in some embodiments of the present application, the model parameters of the trained VIT model are reloaded into the VIT portion of the TDVG and SDVG models in the domain adaptation phase, resulting in an SDVG model (as a specific example of a source domain generator) and a TDVG model (as a specific example of a domain generator to be trained). The TDVG model 230, domain discriminator 221, and classifier 231 are then trained using the target domain dataset to obtain a target TDVG model 240, a target discriminator, and a target classifier. Specifically, the two-dimensional flow grayscale image is input into the SDVG model and the TDVG model, respectively, to obtain the source domain output result and the target domain output result. The domain discriminator 221 and the classifier 231 then learn the source domain output result and the target domain output result to obtain the target domain generator and the target discriminator.

[0074] In some embodiments of the present application, S320 may include: inputting the target domain output result into the initial classifier to obtain a classification result; adjusting the parameters of the initial classifier by comparing the classification result with the label data corresponding to the two-dimensional traffic grayscale image data to obtain the target classifier.

[0075] For example, in some embodiments of the present application, specifically, the target domain output result is forward calculated and outputted by the classifier 231 (as a specific example of the classification result) and compared with the label. After the MMD loss is calculated, the model parameters are continuously updated and iterated until the accuracy requirements are met, thereby obtaining the target classifier.

[0076] In some embodiments of the present application, S320 may include: inputting the source domain output result and the target domain output result into the initial discriminator to obtain a discrimination result; optimizing the parameters of the initial discriminator through the discrimination result to obtain the target discriminator; and optimizing the domain generator to be trained using the discrimination result and the classification result to obtain the target domain generator.

[0077] For example, in some embodiments of the present application, domain discriminator 221 is used to determine whether two input data belong to the same image domain (e.g., source domain or target domain). Domain discriminator 221 performs a forward calculation on the source domain output and the target domain output (as a specific example of the discrimination result), compares them with the actual domain of the image, and after calculating the MMD loss, continuously updates the model parameters until the accuracy requirement is met, thereby obtaining a target discriminator. Simultaneously, the forward calculation output of domain discriminator 221 and the forward calculation output of classifier 231 are used to comprehensively optimize the parameters of the TDVG model until the accuracy requirement is met, thereby obtaining a target TDVG model 240.

[0078] From the above, we can see that during the second stage of training, the parameters of the SDVG model remain unchanged.

[0079] S330, loading the target domain generator into an initial reinforcement model, and training the initial reinforcement model using the target domain dataset to obtain a target traffic detection model, wherein the initial reinforcement model includes: the target domain generator and different scenario classifiers.

[0080] For example, in some embodiments of the present application, the parameters of the target TDVG model 240 are loaded into the third stage to enhance the model learning and fitting process. The target TDVG model 240 and the enhanced model 250 are trained on the target domain dataset to obtain the target traffic detection model.

[0081] In some embodiments of the present application, S330 may include: splicing the target domain generator and the scene classifier to obtain the initial reinforcement model; inputting the two-dimensional traffic grayscale map data in the target domain data set into the initial reinforcement model respectively to obtain the scene classification result; comparing the scene classification result with the label data corresponding to the two-dimensional traffic grayscale map data, adjusting the parameters of the scene classifier, and obtaining the target traffic detection model.

[0082] For example, in some embodiments of the present application, the target TDVG model 240 is spliced ​​with the scene classifier CNN in different scenarios (for example, a binary classification scenario) to obtain an initial reinforcement model, and the two-dimensional traffic grayscale image is input into the initial reinforcement model to obtain the forward calculation output in the model network structure (as a specific example of the scene classification result) and compare it with the label, and continuously update and iterate the initial reinforcement model parameters to improve the detection accuracy, so as to obtain a target traffic detection model applied to different scenarios.

[0083] In other embodiments of the present application, the method for training a traffic detection model may further include: using a test set to infer the target traffic detection model to obtain an evaluation index of the target traffic detection model.

[0084] For example, a target traffic detection model can be applied to a test set in a target domain dataset for inference testing to test accuracy. The evaluation metric results can be used to determine whether to continue training the target traffic detection model or complete training. For example, the evaluation metric can be compared with a preset threshold. If the threshold is higher than the threshold, training is completed. The preset threshold can be set based on actual conditions.

[0085] Specifically, the accuracy rate A CC It is an evaluation indicator, and its related calculation method is as follows:

[0086]

[0087] Among them, TP represents the number of samples that the target traffic detection model predicts as positive samples; TN represents the number of samples that the target traffic detection model predicts as negative samples; FP represents the number of samples that the target traffic detection model predicts as positive samples; FN represents the number of samples that the target traffic detection model predicts as negative samples.

[0088] The following is combined with Figure 4 The specific training model architecture diagram provided by some embodiments of the present application is exemplified.

[0089] Depend on Figure 4 As can be seen, training the traffic detection model consists of three stages: (1) source domain learning stage; (2) domain adaptive transfer learning stage; and (3) target domain enhancement stage. Before training each stage, the source domain data (i.e., source domain dataset) and the target domain data (i.e., target domain dataset) are both preprocessed (for details, please refer to the preprocessing process provided above). The following is an illustrative explanation of the implementation principles of these three stages.

[0090] (1) Source domain learning stage: This application embodiment designs a ViT (also known as VIT, which is case-insensitive) model to train and learn labeled source domain data, so as to enable the ViT model to learn source domain data knowledge. ViT has excellent results in computer vision task scenarios and has good time series learning capabilities through the multi-head attention mechanism. The ViT architecture can cut the traffic feature image with time information after preprocessing through the multi-head attention mechanism, and cut it according to the hyperparameter patch_wide=28 in the ViT model to restore the original RGB traffic data image with time information for the ViT model to learn and train traffic feature information. The adopted ViT solution structure can be combined with the transformer structure for time series learning, and has good traffic time series information learning capabilities. The parameters of the ViT model used in the embodiment of this application are deep: 3, multi-head: 16.

[0091] (2) Domain Adaptive Transfer Learning Phase: This embodiment of the application designs the ViT-GAN architecture, whose main architecture is GANs, and ViT will be applied to the generative adversarial network of GANs. In this phase, the model learns to master the target domain knowledge with the help of source domain knowledge. ViT-GAN consists of four parts:

[0092] Source domain ViT generation network, target domain ViT generation network, domain discrimination network (or called domain discriminator) and classification network (or called classifier). Part of the network structure of SDVG and TDVG is mainly the same as the first part of ViT, such as Figure 5As shown in the figure, the difference is that the last two fully connected layers and the Softmax layer of the ViT model are converted into a layer that converts the one-dimensional 784 into a two-dimensional 28*28 image output layer. The structure of the output layer includes three layers of reverse convolution layers, that is, the one-dimensional output is converted into a two-dimensional image output, which is beneficial to the domain classification detection of the discriminant network.

[0093] The model parameters of SDVG and TDVG are initialized by the parameters of the source domain ViT model in the source domain learning phase. That is, by overloading the model parameters of the first phase into the SDVG and TDVG models, they are equipped with initial learning knowledge. However, the difference is that the model parameters of SDVG are frozen during the training process, while the model parameters of TDVG are continuously updated and optimized during the learning and training of target domain data.

[0094] The domain discrimination network is a CNN model structure consisting of a three-layer convolutional network. Finally, sigmoid is used to output and classify the results. In the embodiment of this application, it is used to classify the domain of the image. This embodiment of the application optimizes the original domain discrimination network and adds MMD to the loss function of the domain discrimination network to enhance the discrimination network's learning of the differences between different domains, thereby achieving knowledge transfer between the source domain and the target domain.

[0095] (3) Target domain enhancement stage: The embodiment of the present application migrates the parameters of the TDVG model of ViT-GAN in the domain adaptive transfer learning stage to the enhanced ViT model with the same architecture in this stage. This stage enables the model to re-learn in the target domain scenario and enhances the model's detection capability for the target domain dataset by enabling personalized use in different scenarios (e.g., binary classification scenarios). The enhanced ViT architecture will serve as a target domain feature extractor to extract target domain traffic features, and design learning layers and classification layers corresponding to the target domain scenario after the ViT architecture to achieve accurate traffic classification in the target domain scenario. In the embodiment of the application, a CNNs network with a 4-layer convolutional structure is designed as an enhanced model. The designed CNN models can be well applied to the binary classification scenario of plaintext and encrypted traffic detection, and the enhanced model is spliced ​​after the ViT network to achieve classification of traffic data in the target domain.

[0096] The following is combined with Figure 4 and attached Figure 6 The specific process of training the traffic detection model provided by some embodiments of the present application is exemplified.

[0097] Please see the attached Figure 6 , Figure 6 A flow chart of a method for training a traffic detection model is provided for some embodiments of the present application.

[0098] It should be noted that the following examples use the CIC-IDS-2012 and CTU-mfcp datasets, with CIC-IDS-2012 serving as the source domain dataset and CTU-mfcp serving as the target domain dataset. By setting different data sizes for the target domain datasets as shown in Table 1, the accuracy of the models trained in the examples of this application can be tested and compared.

[0099] Table 1

[0100]

[0101] The above implementation process is described below by way of example.

[0102] S610: Obtain a training set and a test set of a source domain dataset and a target domain dataset.

[0103] For example, as a specific example of this application, by preprocessing the raw traffic data in Table 1, the traffic data is first cleaned to remove empty IP address traffic communication packets, and then the first 784 bytes of data from each communication packet are extracted. Finally, through data preprocessing, the corresponding model input data is generated, that is, a two-dimensional traffic grayscale image of size 28*28 as data for model training and detection. The data generated by preprocessing is divided into a training set and a test set. Both the training set and the test set contain two categories: normal traffic and malicious traffic. All data have correct label classification. All source domain data sets and target domain data sets contain test set and training set parts.

[0104] S620: Train the initial image classification model using the source domain dataset to obtain a target image classification model.

[0105] For example, as a specific example of this application, the training set in the source domain dataset is used to train the source domain model through the source domain learning phase, completing the first phase of training of the ViT model in the CIC-IDS-2012 source domain dataset to obtain a trained ViT model.

[0106] S630: Load the model parameters of the target image classification model into the generative adversarial network model, and train the generative adversarial network model using the target domain dataset to obtain a target domain generator.

[0107] For example, as a specific example of this application, a portion of the network structure from the ViT model trained in S620 is loaded into the ViT portion of the generative adversarial network portion of the model at this stage, and domain adaptive transfer learning is performed at this stage based on the target domain dataset. The target domain generation network in the generative adversarial network portion trains and learns model parameters based on the game with the domain discriminator in the GAN network. Ultimately, training based on the target domain dataset CTU-mfcp is completed to obtain the target domain generation network (i.e., the target domain generator), achieving knowledge transfer.

[0108] S640: Load the target domain generator into the initial enhanced model, and train the initial enhanced model using the target domain dataset to obtain a target traffic detection model.

[0109] For example, as a specific example of the present application, the target domain generation network trained in the second stage of S630 is used as the feature extractor model of the target domain enhancement model in this stage, and the classification model CNN of the subsequent target domain scene is spliced, and finally trained based on the target domain dataset CTU-mfcp training set to obtain the target traffic detection model.

[0110] S650: Inferring the target traffic detection model using the test set in the target domain dataset to obtain an inference result.

[0111] For example, as a specific example of this application, an inference calculation is performed based on the target traffic detection model after completing the third stage of training and learning. The inference calculation process no longer performs backpropagation to update the model parameters, and the model's prediction results for the input data are obtained through forward calculation. In this stage, combined with the test set of CTU-mfcp, the advantages of the target traffic detection model obtained by the scheme proposed in this article are compared under different scale data sets. The final inference results are shown in Table 2:

[0112] Table 2

[0113]

[0114] It can be seen from Table 2 that the target flow detection model trained by the scheme proposed in this paper has a higher overall accuracy.

[0115] It should be noted that the specific implementation process of S610 to S650 can refer to the method embodiment provided above, and to avoid repetition, it is not described here.

[0116] It can be seen from the training model methods provided in some embodiments of the above application that the embodiment of the present application designs and proposes a three-layer transfer learning model that combines the MMD function with GANs, and applies it to malicious traffic detection scenarios. With the help of the designed domain-adaptive transfer learning model, the problem of requiring a huge labeled data set in the training link of traditional deep learning anomaly detection is solved, and the model can achieve efficient learning and training in a smaller number of new scene data sets to achieve high-precision detection. Moreover, compared with the existing solutions, the proposed solution combines MMD with GANs, which can use MMD to effectively reduce the deviation of global data features while using the characteristics of the adversarial game of GANs to achieve the effect of reducing the offset of the global data distribution. It can achieve better detection results with lower data sets.

[0117] The following is combined with Figure 7 The specific process of flow detection provided by some embodiments of the present application is exemplified.

[0118] Please see the attached Figure 7 , Figure 7 A flow chart of a traffic detection method provided in some embodiments of the present application includes: S710, obtaining a trained target traffic detection model; S720, inputting the traffic to be detected into the target traffic detection model, and obtaining a traffic classification result output by the target traffic detection model, wherein the traffic classification result indicates whether the traffic to be detected is normal traffic or malicious traffic.

[0119] For example, in some embodiments of the present application, the target traffic detection model trained by the above training method detects the traffic to be detected to confirm whether it is malicious traffic, thereby achieving accurate detection of the traffic.

[0120] Please refer to Figure 8 , Figure 8 A block diagram of the components of an apparatus for training a traffic detection model provided in some embodiments of the present application is shown. It should be understood that the apparatus for training a traffic detection model corresponds to the aforementioned method embodiments and is capable of executing each step involved in the aforementioned method embodiments. The specific functions of the apparatus for training a traffic detection model can be found in the description above, and a detailed description is omitted here to avoid repetition.

[0121] Figure 8The device for training a traffic detection model includes at least one software functional module that can be stored in a memory in the form of software or firmware or solidified in the device for training a traffic detection model. The device for training a traffic detection model includes: a first training module 810, configured to train an initial image classification model using a source domain dataset to obtain a target image classification model; a second training module 820, configured to load the model parameters of the target image classification model into a generative adversarial network model, and train the generative adversarial network model using a target domain dataset to obtain an image generation model, wherein the generative adversarial network model includes: an initial source domain generator, an initial target domain generator, an initial discriminator, and an initial classifier; the image generation model includes: the source domain generator, the target domain generator, the target discriminator, and the target classifier; a third training module 830, configured to load the target domain generator into an initial reinforcement model, and train the initial reinforcement model using the target domain dataset to obtain a target traffic detection model, wherein the initial reinforcement model includes: the target domain generator and different scene classifiers.

[0122] Please refer to Figure 9 , Figure 9 The following is a block diagram illustrating the composition of a flow detection device provided in some embodiments of the present application. It should be understood that the flow detection device corresponds to the above-mentioned method embodiment and can perform each step involved in the above-mentioned method embodiment. The specific functions of the flow detection device can be found in the description above. To avoid repetition, a detailed description is appropriately omitted here.

[0123] Figure 9 The flow detection device includes at least one software functional module that can be stored in a memory in the form of software or firmware or solidified in the flow detection device, and the flow detection device includes: an acquisition module 910, configured to obtain a trained target flow detection model; a detection module 920, configured to input the flow to be detected into the target flow detection model, and obtain a flow classification result output by the target flow detection model, wherein the flow classification result characterizes whether the flow to be detected is normal flow or malicious flow.

[0124] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0125] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0126] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0127] like Figure 10 As shown, some embodiments of the present application provide an electronic device 1000, which includes: a memory 1010, a processor 1020, and a computer program stored in the memory 1010 and executable on the processor 1020, wherein the processor 1020 can implement a method as described in any of the above embodiments when reading the program from the memory 1010 through the bus 1030 and executing the program.

[0128] Processor 1020 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 1020 can be a microprocessor.

[0129] The memory 1010 can be used to store instructions executed by the processor 1020 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of this application. The processor 1020 of the embodiment of the present disclosure can be used to execute the instructions in the memory 1010 to implement the method shown above. The memory 1010 includes dynamic random access memory, static random access memory, flash memory, optical storage, or other memory known to those skilled in the art.

[0130] The foregoing is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included within the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0131] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0132] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for training a traffic detection model, characterized in that: include: Use the source domain dataset to train the initial image classification model to obtain the target image classification model; Loading the model parameters of the target image classification model into a generative adversarial network model, and training the generative adversarial network model using a target domain dataset to obtain an image generation model, wherein the generative adversarial network model includes: an initial source domain generator, an initial target domain generator, an initial discriminator, and an initial classifier; and the image generation model includes: a source domain generator, a target domain generator, a target discriminator, and a target classifier; The target domain generator is loaded into an initial reinforcement model, and the initial reinforcement model is trained using the target domain dataset to obtain a target traffic detection model, wherein the initial reinforcement model includes: the target domain generator and different scene classifiers; Before using the source domain dataset to train the initial image classification model, the method further includes: segmenting and cleaning the original traffic data to obtain multiple communication packets, wherein the original traffic data includes: source domain traffic data and target domain traffic data; extracting set length traffic data from each communication packet in the multiple communication packets; converting the set length traffic data to obtain two-dimensional traffic grayscale map data; and constructing the source domain dataset and the target domain dataset using the two-dimensional traffic grayscale map data and label data corresponding to the two-dimensional traffic grayscale map data; The target domain generator is loaded into the initial reinforcement model, and the initial reinforcement model is trained using the target domain data set to obtain the target traffic detection model, including: splicing the target domain generator with the scene classifier to obtain the initial reinforcement model; inputting the two-dimensional traffic grayscale map data in the target domain data set into the initial reinforcement model to obtain a scene classification result; comparing the scene classification result with the label data corresponding to the two-dimensional traffic grayscale map data, adjusting the parameters of the scene classifier, and obtaining the target traffic detection model.

2. The method according to claim 1, wherein The method of training the initial image classification model using the source domain dataset to obtain the target image classification model includes: Inputting the two-dimensional flow grayscale image data in the source domain data set into the initial image classification model to obtain first output data; The first output data is compared with the label data corresponding to the two-dimensional flow grayscale image data, and the parameters of the initial image classification model are optimized to obtain the target image classification model.

3. The method according to claim 1, wherein The step of loading the model parameters of the target image classification model into a generative adversarial network model and training the generative adversarial network model using a target domain dataset to obtain an image generation model comprises: Loading the model parameters into the initial source domain generator and the initial target domain generator to obtain a source domain generator and a domain generator to be trained; Inputting the two-dimensional flow grayscale image data in the target domain data set into the source domain generator and the to-be-trained domain generator respectively to obtain a source domain output result and a target domain output result; Obtaining the target classifier according to the target domain output result; According to the source domain output result and the target domain output result, the target domain generator and the target discriminator are obtained.

4. The method according to claim 3, wherein The step of obtaining the target classifier according to the target domain output result includes: Inputting the target domain output result into the initial classifier to obtain a classification result; The target classifier is obtained by comparing the classification result with the label data corresponding to the two-dimensional traffic grayscale image data and adjusting the parameters of the initial classifier.

5. The method according to claim 4, wherein The obtaining of the target domain generator and the target discriminator according to the source domain output result and the target domain output result includes: Inputting the source domain output result and the target domain output result into the initial discriminator to obtain a discrimination result; Optimizing the parameters of the initial discriminator according to the discrimination result to obtain the target discriminator; The domain generator to be trained is optimized using the discrimination result and the classification result to obtain the target domain generator.

6. A method for flow detection, characterized in that: include: Obtaining a target flow detection model trained by the method according to any one of claims 1 to 5; The traffic to be detected is input into the target traffic detection model to obtain a traffic classification result output by the target traffic detection model, wherein the traffic classification result characterizes whether the traffic to be detected is normal traffic or malicious traffic.

7. A device for training a traffic detection model, the device being used to execute the method according to claim 1, characterized in that: include: A first training module is configured to train an initial image classification model using a source domain dataset to obtain a target image classification model; a second training module configured to load the model parameters of the target image classification model into a generative adversarial network model, and train the generative adversarial network model using a target domain dataset to obtain an image generation model, wherein the generative adversarial network model includes: an initial source domain generator, an initial target domain generator, an initial discriminator, and an initial classifier; and the image generation model includes: a source domain generator, a target domain generator, a target discriminator, and a target classifier; The third training module is configured to load the target domain generator into an initial reinforcement model, and train the initial reinforcement model using the target domain dataset to obtain a target traffic detection model, wherein the initial reinforcement model includes: the target domain generator and different scenario classifiers.

8. A flow detection device, characterized in that: include: An acquisition module, configured to acquire a target flow detection model trained by the method according to any one of claims 1 to 5; The detection module is configured to input the traffic to be detected into the target traffic detection model to obtain a traffic classification result output by the target traffic detection model, wherein the traffic classification result characterizes whether the traffic to be detected is normal traffic or malicious traffic.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, executes the method for training a traffic detection model according to any one of claims 1 to 5 or the method for traffic detection according to claim 6.

10. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program, when run by the processor, executes the method for training a traffic detection model as described in any one of claims 1 to 5 or the method for traffic detection as described in claim 6.

Images